ENGIE discloses breach of customer contact and contract data via partner marketing tool

Customers in France are being warned to watch for phishing, since names, addresses and contract identifiers were taken, though no banking data was affected.

French energy company ENGIE says attackers stole customer data after breaching a marketing tool that its business partners use for customer prospecting and promoting energy offers. ENGIE states its internal IT systems were not compromised and that it cut the attackers' access to the platform. The company says the exposed data is limited to customers' contact details and some energy contract information, with no banking data affected, and that the incident is confined to customers in France. ENGIE has informed the relevant authorities and written to each affected customer, advising them to guard against fraud and phishing. It has not attributed the intrusion to a named group, and no ransomware operation or extortion gang has claimed it as of publication. For developers and operators, the case shows that third-party tooling with access to customer records is a real exposure point even when core systems stay intact.