ENGIE breach exposes customer details through partner sales tool

ENGIE has disclosed a data breach in which attackers accessed customer information through a partner sales tool used to market electricity and natural gas offers. Internal IT systems were not compromised and banking data appears unaffected, according to a spokesperson cited by BleepingComputer. The incident involved a tool used by ENGIE’s partners, and notification emails to affected customers confirm unauthorised access to personal data stored in that system.

Exposure covers customer names, postal and email addresses, telephone numbers, customer IDs, contract numbers and energy supply identifiers. For electricity customers, the metering point identifiers (PDL) are included; for gas customers, metering and estimation points (PCE) are cited. ENGIE has not disclosed the partner or platform involved, nor how many customers were affected, when the intrusion began or when it was discovered.

While financial data is stated as unaffected, the compromised information could still enable impersonation or social-engineering fraud, as attackers may use accurate details to pressure individuals into revealing more information or making payments. The company urges customers to verify unexpected requests through trusted channels and to avoid signing in via email links, with guidance to rely on ENGIE’s official site or app. No group has claimed the attack.