Energy giant ENGIE discloses data breach affecting customers

French energy giant ENGIE confirmed that attackers stole customer data after breaching a marketing platform used by business partners, according to BleepingComputer's report. ENGIE is one of the world's largest power and natural gas providers. The company operates in renewable energy, infrastructure, and customer energy supply in 30 countries, employs over 90,000 people, and reported €71.9 billion in revenue last year.

This account is for ENGIE customers in France and for anyone who received a breach notification letter. It sets out which records those letters say were exposed, what ENGIE says stayed off its own IT systems, and what the company has not given: a victim count, a threat group, or the name of the partner tool. Sergiu Gatlan's report is dated October 27, 2026, at 05:25 AM.

What broke in Energy giant ENGIE discloses data breach

The failure ENGIE described sits in a marketing platform business partners use, not in the company's own network. A spokesperson said, "ENGIE's internal IT systems were not compromised. ENGIE recently identified unusual data access activity within a tool used by partners as part of their customer prospecting activities and the marketing of energy offers." Attackers stole customer data from that platform. ENGIE told BleepingComputer it cut off the attackers' access to the compromised platform. ENGIE says the partner platform is the system that was hit.

ENGIE did not attribute the attack to a specific threat group. No ransomware operation or extortion gang had claimed the ENGIE breach before the October 27, 2026 publication. One year ago, the Scattered LAPSUS$ Hunters extortion group leaked records they claimed to have stolen after allegedly breaching a Salesforce instance of Engie Records, the retail energy supply subsidiary of ENGIE North America. That earlier claim names a different subsidiary, a Salesforce instance, and ENGIE North America. The new statement is about a partner tool and customers in France.

Who is exposed by Energy giant ENGIE discloses data breach

The spokesperson did not say how many customers were affected. ENGIE told BleepingComputer the incident is limited to customers in France. ENGIE operates in 30 countries with over 90,000 employees and €71.9 billion in revenue last year, but it placed this breach on French customers only. Since the attack, ENGIE has notified relevant authorities and contacted affected customers to inform them of the breach. It said it individually informed each customer concerned. ENGIE also runs a customer energy supply business.

Breach notification letters sent to affected customers name the fields, which the spokesperson did not list when speaking to BleepingComputer. The letters say the threat actors gained access to first and last names, mailing address, email address, phone number, Delivery Point (PDL) or Metering and Estimation Point (PCE), customer ID, and contract number. ENGIE said, "The investigations conducted to date indicate that the data concerned is limited to customers' contact details and certain information relating to their energy contracts. No banking data is affected."

What to do now about Energy giant ENGIE discloses data breach

ENGIE said, "In the interest of transparency, ENGIE individually informed each customer concerned and reminded them of the precautionary measures they should take to protect themselves against potential fraud or phishing attempts." Those customers are the people in France whom the company has already contacted. The letters they received list first and last names, mailing address, email address, phone number, Delivery Point (PDL) or Metering and Estimation Point (PCE), customer ID, and contract number as data the threat actors accessed.

ENGIE said no banking data is affected, and that the data concerned is limited to contact details and certain information relating to energy contracts. The spokesperson said the company cut off the attackers' access to the compromised platform and that internal IT systems were not compromised. ENGIE has notified relevant authorities. It has not named a threat group. No ransomware operation or extortion gang had claimed this breach before publication on October 27, 2026, at 05:25 AM. The company described the incident as limited to customers in France.

How the Energy giant ENGIE discloses data breach issue works

Partners use the affected tool for customer prospecting activities and for the marketing of energy offers. ENGIE recently identified unusual data access activity in that tool. Attackers stole customer data after breaching the marketing platform those business partners use. The spokesperson said ENGIE's internal IT systems were not compromised, and that ENGIE cut off the attackers' access to the compromised platform. The company has not named the tool. It has not said how the unusual access started or how long it continued before access was cut off.

Customer letters describe what the threat actors could reach once they were in the platform. They gained access to first and last names, mailing address, email address, phone number, Delivery Point (PDL) or Metering and Estimation Point (PCE), customer ID, and contract number. ENGIE's statement to BleepingComputer puts that set under contact details and certain information relating to energy contracts, and it says no banking data is affected. Each customer concerned was informed individually. The incident, as ENGIE stated it, stops at the partner platform and at customers in France.

What is still unknown about Energy giant ENGIE discloses data breach

ENGIE did not give a count of affected customers. It did not name the marketing platform, the partner tool, or a threat group. No ransomware operation or extortion gang had claimed the breach before publication. One year ago, Scattered LAPSUS$ Hunters leaked records they claimed to have stolen after allegedly breaching a Salesforce instance of Engie Records, the retail energy supply subsidiary of ENGIE North America. ENGIE has not tied that claim to the French partner-tool incident reported on October 27, 2026.

The letters are more specific than the statement ENGIE gave BleepingComputer. Investigations conducted to date, the company said, show data limited to customers' contact details and certain information relating to their energy contracts, with no banking data affected. The letters add Delivery Point (PDL) or Metering and Estimation Point (PCE), customer ID, and contract number next to first and last names, mailing address, email address, and phone number. The disclosure does not list the precautionary measures ENGIE reminded customers to take against potential fraud or phishing attempts, and ENGIE did not name the authorities it notified.