Engie customers warned of data exposure in supply chain breach

Engie, the French multinational energy giant, has notified an undisclosed number of customers that their personal data may have been compromised in a recent breach linked to a third-party marketing platform used by its partners. The company confirmed that its own IT systems were not compromised and attributed the incident to access to a marketing tool used for customer prospecting and energy offers in France.

Engie said the access was disabled as soon as the unusual activity was detected and that an in-depth technical investigation was launched to determine the scope and secure the environment. It also said enhanced monitoring measures have been put in place.

According to screenshots of the customer notification posted to X, affected data could include full name, postal and email address, telephone number, unique energy supply IDs (PCE/PDL), customer ID and contract number; banking data was not involved. No group has claimed responsibility at the time of writing.

The breach follows previous disclosure in October last year that the extortion group Scattered LAPSUS$ Hunters claimed to have compromised Engie’s US retail energy business, Engie Resources, and to have exfiltrated around 3GB of data. Separate insurer data cited by Infosecurity suggested that, in Europe, reported ransomware losses in the sector have been limited, with fraud or exposed customer data dominating.