French energy provider ENGIE has confirmed attackers stole customer data after breaching a marketing platform used by its business partners. The incident is limited to customers in France, and ENGIE did not disclose how many customers were affected.

Partner platform, not internal systems

The compromised tool was used by partners for customer prospecting and marketing energy offers. ENGIE said its internal IT systems were not compromised and that it cut off the attackers' access. The company operates in 30 countries, employs over 90,000 people, and reported €71.9 billion in revenue last year.

What data was involved

Data in breach notification letters included first and last names, mailing address, email address, phone number, Delivery Point or Metering and Estimation Point, customer ID and contract number. ENGIE said no banking data was affected and the data concerned is limited to contact details and certain information relating to energy contracts.

ENGIE notified relevant authorities, individually informed each customer concerned, and reminded them of precautions against potential fraud or phishing. It did not attribute the attack to a specific threat group, and no ransomware operation or extortion gang had claimed the breach before publication. The breach was disclosed on 27 October 2026.

Sources: BleepingComputer and SC Media.