“A malicious person could use the information mentioned above to impersonate you or use your personal details to contact another organization in your name, obtain additional information, or attempt to make a payment,” Engie warned in its customer notification.
Engie confirms third‑party marketing platform breach
French multinational Engie has notified an undisclosed number of customers that their personal data may have been exposed after unusual access activity was detected in a tool used by partners for customer prospecting and marketing of energy offers in France. The company said its own IT systems were not compromised and attributed the incident to a third‑party marketing platform that was “compromised by threat actors.” Engie told Infosecurity that the activity was identified, the relevant access was disabled, and the firm has launched an in‑depth technical investigation.
Types of customer data reportedly exposed
Screenshots of the customer notification shared on X list the categories of data potentially affected: full name, postal and email address, telephone number, unique IDs for energy supply (PCE/PDL), customer ID, and contract number. Engie confirmed that no banking data was involved. The company advised customers to be alert for fraud and phishing attempts that could use the exposed details to impersonate customers or to contact other organisations in customers' names.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadImmediate containment and monitoring measures
According to the firm’s statement, access to the compromised tool was disabled “as soon as this activity was detected.” Engie said it launched a technical investigation to determine scope and identify potentially affected customers, and that “enhanced monitoring measures” were put in place while the investigation proceeded. Engie also told customers to watch for fraudulent emails that may “appear to come from trusted sources” and to treat unsolicited payment or account‑verification requests with suspicion.
Prior claimed incident involving Scattered LAPSUS$ Hunters
No extortion group had publicly claimed responsibility for this latest incident at the time of reporting, and Engie said the situation was contained. The company’s notification follows an earlier claimed compromise: in October last year, extortion group Scattered LAPSUS$ Hunters listed Engie on its leak site after claiming to have compromised more than 100 Salesforce instances and to have extracted over one billion records. In that prior case, Engie’s US retail energy business, Engie Resources, was named as a victim, with the group claiming to have obtained 3GB of data.
What this means for customers, insurers, and energy procurement
- Customers: Engie’s guidance to customers focused on fraud avoidance: expect phishing attempts that leverage real names, addresses, phone numbers, contract numbers, or unique supply IDs, and treat unexpected requests for further personal or payment details as suspect.
- Insurers and claims handlers: Data from insurer Resilience shared with Infosecurity indicates a regional difference in energy‑sector loss patterns. According to Resilience, no UK or European energy and utilities clients on record had reported ransomware since July 2025, and European claims with recorded cost involved only fraud or exposed customer data. In contrast, Resilience said ransomware accounted for roughly 70% of incurred losses in US energy‑sector claims on record.
- Energy procurement and partner management: Engie’s attribution of the incident to a partner‑used marketing platform highlights the operational exposure created by third‑party tools used in customer acquisition and marketing. The firm’s sequence — detection, disabling access, investigation, and enhanced monitoring — illustrates a containment pathway companies may follow when partner tools are involved.
Engie employs over 90,000 people across 30 countries and reported revenue of almost €72bn ($80bn) in 2025. The company says the incident is contained, but it has not disclosed how many customers were affected. For affected customers, the immediate practical hazard is not financial theft via bank records—Engie confirmed banking data was not exposed—but impersonation and fraud using the kinds of identity and contract details listed in the notification.
Original reporting: https://www.infosecurity-magazine.com/news/energy-giant-engie-supply-chain/
