Energy Giant Engie Notifies Customers of Supply Chain Breach
French multinational Engie has alerted customers to a data breach originating from a compromised third-party marketing platform, potentially exposing personal information.
French energy giant Engie has informed an undisclosed number of its customers that their personal data may have been accessed due to a supply chain incident. The company, a major global supplier of natural gas and a significant player in nuclear and renewable energy, employs over 90,000 people across 30 countries and reported nearly €72 billion in revenue in 2025.
The compromised data, as detailed in customer notifications, could include full names, postal and email addresses, telephone numbers, unique energy supply identifiers (PCE/PDL), customer IDs, and contract numbers. Engie has explicitly stated that no banking or financial data was affected by the breach.
In response to the incident, Engie is urging its customers to remain vigilant against potential fraud and phishing attempts. The company warned that the exposed information could be used by malicious actors to impersonate customers, obtain additional personal details from other organizations, or conduct fraudulent transactions.
Engie clarified that its own internal IT systems were not directly compromised. The breach originated from a third-party marketing platform utilized by its partners for customer prospecting and the promotion of energy offers in France. Threat actors gained unauthorized access to this platform.
Upon detecting the unusual data access activity, Engie promptly disabled the relevant access and initiated a thorough technical investigation. The company aims to fully understand the incident's circumstances, precisely determine the scope of affected customers, and ensure the security of the situation has been restored. Enhanced monitoring measures have also been implemented.
As of the latest reports, no known extortion group has claimed responsibility for the breach, which Engie has stated is now contained. This incident echoes a previous event in October of the previous year, where the group Scattered LAPSUS$ Hunters claimed to have obtained 3GB of data from Engie Resources, the firm's US retail energy business, following a compromise of over 100 Salesforce instances.
Data from insurer Resilience indicates a trend of European energy and utilities clients reporting fraud or exposed customer data rather than ransomware attacks since July 2025. This contrasts sharply with the US market, where ransomware accounts for approximately 70% of incurred losses in the sector, highlighting differing threat landscapes across regions.
The incident underscores the persistent risks inherent in supply chain security, particularly for critical infrastructure operators. The reliance on third-party vendors for customer engagement and marketing activities creates potential entry points for attackers, necessitating robust vendor risk management and continuous security monitoring.