French energy company ENGIE has confirmed that hackers stole customer information after gaining unauthorized access to a marketing platform used by its business partners. The incident affected customers in France, although the company has not disclosed how many individuals had their information compromised.
Unlike attacks that directly penetrate a company’s internal network, this breach involved a separate platform supporting customer acquisition and the promotion of energy contracts. ENGIE told BleepingComputer that its internal IT systems were not compromised and that the attackers’ access to the affected platform had been terminated.
The stolen information includes customers’ names, postal addresses, email addresses and telephone numbers. According to breach notifications, the exposed records also contained customer identification numbers, contract references and identifiers associated with electricity and gas supply points.
These identifiers, known in France as PDL and PCE numbers, are used to identify electricity delivery locations and gas metering points. Although they are not payment credentials, they could make fraudulent communications appear more convincing when combined with other personal details.
ENGIE emphasized that banking information was not affected by the incident. The company has also notified relevant authorities and contacted impacted customers individually, providing information about the breach and potential risks.
The exposed information could be particularly useful for phishing and impersonation attempts. Criminals possessing authentic customer and contract details may be able to send convincing messages about unpaid energy bills, account verification, or changes to service agreements.
Customers receiving unexpected communications claiming to represent ENGIE should therefore verify requests through the company’s official channels. Messages demanding banking details, passwords or urgent payments deserve particular scrutiny, even when they contain accurate account information.
The company has not explained how the attackers initially compromised the marketing platform. It has also not identified the service provider involved, disclosed the duration of unauthorized access, or attributed the intrusion to a particular threat group.
As of October 27, 2026, no ransomware or extortion operation had publicly claimed responsibility for the incident. There was also no confirmed evidence connecting the breach to previously reported allegations involving another ENGIE-related business.
ENGIE operates across 30 countries and employs more than 90,000 people, making it one of Europe’s major energy providers. Its extensive network of commercial partners illustrates how sensitive customer information can be exposed through external services even when a company’s primary infrastructure remains secure.