ENGIE, the French multinational that supplies electricity and natural gas to millions of homes and businesses, has confirmed that customer information was stolen after attackers got into a sales and marketing tool used by its business partners. The company says its own internal IT systems were not breached and that no banking details were exposed, but the stolen records are exactly the kind of data scammers use to make fake "energy supplier" calls and emails look convincing.
What happened
According to a statement ENGIE gave to BleepingComputer, the company recently spotted unusual data access activity inside a platform that partner companies use to prospect for new customers and sell ENGIE energy offers. ENGIE says it has since cut off the attackers' access to that tool, notified the relevant authorities, and contacted the affected customers individually.
ENGIE has not named the compromised platform, the partner involved, or the software vendor behind the tool. French security site Cyberattaque.org, which obtained a copy of the customer notification email, reports that the company describes the incident as an act of cyber-malice affecting a commercial tool made available to some of the outside sales firms that market its contracts.
Who is affected
ENGIE says the incident is limited to customers in France. It has not said how many people are affected. No ransomware or data extortion group had publicly claimed responsibility for the attack at the time of reporting, and ENGIE has not attributed it to any specific threat actor.
This is not the first time ENGIE customers have heard bad news this month. Cyberattaque.org notes that on October 2, 2026, the company told some customers about a separate incident at a service provider that supplies customer communication and interaction-management tools. That earlier notice covered contact details, contract numbers and some excerpts of exchanges with customer service.
What data was exposed
In the breach notification letters sent to customers, ENGIE lists the following information as accessed by the attackers:
- First and last name
- Mailing address, email address and phone number
- Customer ID and contract number
- The electricity Delivery Point (PDL) or gas Metering and Estimation Point (PCE) identifier
ENGIE says the data is limited to contact details and certain information about customers' energy contracts, and that banking information was not involved.
Why it matters
On their own, PDL and PCE numbers can't be used to log in to a customer account. But they are unique identifiers tied to a specific home's electricity or gas supply, and they're routinely requested when someone signs up for a contract or switches providers. Paired with a real name, address, contract number and phone number, they give fraudsters a powerful way to sound legitimate.
A scammer could call or email pretending to be ENGIE or a rival supplier, mention a real contract number or meter identifier to build trust, and then push the victim to "confirm" banking details, read out a one-time SMS code, or agree to a fraudulent contract change. Breaches at third-party partners and vendors like this one are increasingly common, because sales and marketing platforms often hold large volumes of customer data with less protection than a company's core systems.
What ENGIE customers should do
- Be suspicious of unexpected contact. Treat any call, text or email about your energy contract, a price change or a supplier switch with caution, even if the caller knows your contract or meter number.
- Never share passwords, banking details or SMS codes. ENGIE says it will never ask for a password or bank details by email, text message or phone.
- Verify through official channels. If you're unsure, hang up and contact ENGIE using the phone number or customer portal listed on your bill, not details given to you by the caller.
- Watch for phishing links. Don't click links in messages claiming to be about refunds, overdue bills or contract updates. Go directly to the official website instead.
- Check your accounts. Keep an eye on your bank statements and energy account for any changes you didn't make.
Businesses that rely on outside sales partners should take this as a reminder to review what customer data those partners can access, enforce strong authentication on shared platforms, and monitor them for unusual bulk data access.
0 Comments