Engie Confirms Customer Data Breach: Urges Caution Against Fraud and Phishing
In a significant development, one of the world’s leading natural gas suppliers, Engie, has informed an undisclosed number of customers regarding a potential compromise of their personal data in a recent cyber breach. This incident has raised alarms not only among customers but also within the broader energy and utilities sector.
Engie, a French multinational corporation headquartered in Paris, has established itself as a major player in the energy supply chain. With over 90,000 employees operating across 30 countries, the company provides services in gas, nuclear energy, and renewable resources. By 2025, Engie reported revenue nearing €72 billion ($80 billion), reflecting its robust presence in the global energy market.
According to screenshots from customer notifications shared on X, the company indicated that the potentially compromised data includes sensitive information such as full names, postal and email addresses, telephone numbers, unique identifiers for energy supply (PCE/PDL), customer IDs, and contract numbers. Engie has reassured its customers that no banking information was involved in this incident, providing a slight comfort amidst a concerning situation.
In light of the breach, Engie is advising customers to remain vigilant against potential fraud and phishing attempts that may arise as a result of this information leak. The company highlighted the risks involved, stating that "a malicious person could use the information mentioned above to impersonate you or use your personal details to contact another organization in your name, obtain additional information, or attempt to make a payment." The warning particularly underscores the possibility of fraudulent emails masquerading as communications from trusted organizations, designed to deceive unsuspecting customers.
In a statement shared with Infosecurity, Engie clarified that its internal IT systems remain intact and were not compromised. The company traced the breach to a third-party marketing platform utilized by its partners, which had fallen victim to cybercriminals. Engie’s statement detailed that the company had recently identified unusual data access activity within this tool, describing it as part of partner activities related to customer prospecting and marketing energy offers in France.
“Once this unusual activity was detected, the relevant access was disabled immediately. Concurrently, Engie initiated a thorough technical investigation to understand the circumstances surrounding the incident thoroughly, accurately assess its extent by identifying potentially affected customers, and launch measures to secure the situation fully. Enhanced monitoring measures have also been implemented,” Engie explained in its statement.
As of now, no group has publicly claimed responsibility for the breach. Engie has expressed confidence that the situation is under control, yet the absence of a clear adversarial acknowledgment raises questions about the incident’s broader implications. Notably, in October of the prior year, the extortion group Scattered LAPSUS$ Hunters had listed Engie on their leak site, alleging the compromise of over 100 Salesforce instances and asserting that they had extracted more than one billion records. In that particular case, Engie’s US retail energy branch, Engie Resources, was reportedly affected, with the group claiming to have accessed approximately 3GB of data.
Interestingly, a recent analysis conducted by the insurer Resilience, and shared with Infosecurity, revealed that, as of July 2025, no ransomware incidents had been reported by UK or European energy and utilities clients. Instead, European claims predominantly involved issues of fraud or exposure of customer data. This trend starkly contrasts with the situation in the United States, where ransomware attacks account for an astonishing 70% of the incurred losses recorded in the energy sector.
As customers navigate these troubling developments, the incident serves as a stark reminder of the vulnerabilities inherent in the increasingly interconnected digital landscape, particularly in the energy sector. Engie’s proactive communication and immediate response signify the company’s commitment to safeguarding its customers and preserving the integrity of its operations. However, the onus also rests on customers to remain informed and cautious, particularly in an age where digital threats pose significant risks to personal and organizational data.
As this story develops, stakeholders in the energy sector are likely to keep a close eye on how Engie addresses this breach and implements further protective measures to prevent similar incidents in the future.