French energy giant ENGIE, a major provider of natural gas and power globally, confirmed that customer data was taken after a breach of a marketing platform utilized by its business partners.
ENGIE, which operates in renewable energy, infrastructure, and customer energy supply across 30 nations, reported revenues of €71.9 billion last year and employs more than 90,000 personnel.
An ENGIE representative informed BleepingComputer that access to the compromised platform was terminated and that the firm's internal systems were not breached. The spokesperson stated, "ENGIE's internal IT systems were not compromised. ENGIE recently identified unusual data access activity within a tool used by partners as part of their customer prospecting activities and the marketing of energy offers."
The scope of the incident is restricted to customers within France, although the spokesperson did not specify the exact number of affected customers. ENGIE has since notified relevant authorities and contacted impacted customers regarding the incident.
"The investigations conducted to date indicate that the data concerned is limited to customers' contact details and certain information relating to their energy contracts. No banking data is affected," ENGIE communicated to BleepingComputer. The company also stated, "In the interest of transparency, ENGIE individually informed each customer concerned and reminded them of the precautionary measures they should take to protect themselves against potential fraud or phishing attempts."
Notification letters sent to affected individuals detailed that threat actors accessed first and last names, mailing addresses, email addresses, phone numbers, Delivery Point (PDL) or Metering and Estimation Point (PCE), customer ID, and contract number.
There was no attribution of the attack to a specific threat group, nor has any ransomware operation or extortion gang claimed responsibility for the ENGIE breach prior to its public disclosure.
This incident highlights how initial access vectors, such as partner platforms, can bypass defenses, as overall prevention scores may obscure subsequent exploitation once valid credentials are leveraged.
The Blue Report 2026 assesses defenses methodically across 338 million simulations conducted within customer production environments.
