ENGIE discloses customer data breach in France

French energy company ENGIE says attackers accessed customer data through a marketing platform used by its business partners. The company told BleepingComputer that it detected unusual data access in a tool partners use to find prospective customers and market energy offers.

ENGIE said it cut off the attackers’ access and that its internal IT systems were not compromised. The company did not say how many customers were affected, but said the incident was limited to customers in France. It notified relevant authorities and contacted affected customers.

According to ENGIE, investigations so far indicate that the affected data is limited to contact details and some information about customers’ energy contracts. The company said no banking data was affected. It also said it individually informed affected customers and reminded them to take precautions against potential fraud or phishing.

ENGIE did not disclose what information was stolen in the attack. However, breach notification letters sent to affected customers reportedly listed first and last names, mailing and email addresses, phone numbers, Delivery Point (PDL) or Metering and Estimation Point (PCE), customer IDs, and contract numbers.

ENGIE has not attributed the attack to a specific group. BleepingComputer reported that no ransomware or extortion group had claimed responsibility for the breach before publication.