ENGIE, a major global energy supplier operating across renewable energy, infrastructure and customer supply networks in 30 countries, has disclosed a data breach affecting its customer base. The company, which employs more than 90,000 people and generated €71.9 billion in revenue in the previous fiscal year, confirmed that unauthorized parties accessed customer information through a compromised marketing platform operated by its business partners.
An ENGIE representative stated that the company severed attacker access to the affected platform and that its own internal systems remained secure. "ENGIE's internal IT systems were not compromised. ENGIE recently identified unusual data access activity within a tool used by partners as part of their customer prospecting activities and the marketing of energy offers," the spokesperson said.
The breach impact is confined to customers located in France, though ENGIE has not disclosed the total number of affected individuals. Following discovery of the incident, the company notified relevant regulatory authorities and reached out directly to impacted customers.
According to ENGIE's statement, the compromised data consists of contact information and energy contract details, with no financial records involved. "The investigations conducted to date indicate that the data concerned is limited to customers' contact details and certain information relating to their energy contracts. No banking data is affected," ENGIE told BleepingComputer.
Breach notification letters sent to affected customers specify the categories of information accessed: first and last names, mailing addresses, email addresses, phone numbers, Delivery Point (PDL) or Metering and Estimation Point (PCE) identifiers, customer ID numbers, and contract numbers.
"In the interest of transparency, ENGIE individually informed each customer concerned and reminded them of the precautionary measures they should take to protect themselves against potential fraud or phishing attempts."
ENGIE has not attributed the attack to any particular threat actor, and no ransomware gang or extortion operation has publicly claimed responsibility for the breach. A year prior, the Scattered LAPSUS$ Hunters group claimed to have stolen records from a Salesforce instance belonging to Engie Records, the retail energy supply subsidiary of ENGIE North America.