Engie Warns Customers After Third-Party Marketing Tool Breach Exposes Personal Details

Engie, a French multinational that employs over 90,000 people across 30 countries, has notified an undisclosed number of customers that their personal data may have been compromised. The exposed information could include full names, postal and email addresses, phone numbers, energy supply identifiers (PCE/PDL), customer IDs and contract numbers. The company confirmed that no banking data was involved.

Engie says its own IT systems were not breached. Instead, it points to a third-party marketing platform that its partners use for customer prospecting and the promotion of energy offers in France. The company reported unusual data access activity in the tool, disabled the relevant access, started a technical investigation and put enhanced monitoring in place. It describes the incident as now contained, and at the time of reporting no extortion group had claimed responsibility.

Engie has warned affected customers to watch for fraud and phishing. It cautioned that criminals could use the details to impersonate people, contact other organisations in their name, or attempt a payment, and that fraudulent emails may appear to come from trusted sources. The source also notes that in October last year the extortion group Scattered LAPSUS$ Hunters listed Engie on its leak site, after claiming to have compromised over 100 Salesforce instances.