ENGIE has begun telling customers in France that unauthorised access exposed their names, addresses, phone numbers and energy contract identifiers.
We are informing you that an act of cyber-malice recently affected a tool used by some of our partners to market energy offers. As part of this incident, unauthorized access to your personal data was identified.
The notice went to households that never dealt directly with ENGIE's own IT systems. ENGIE said the entry point was a sales tool used by some of its business partners.
Threat actors compromised a marketing platform that ENGIE’s partners used, the company said. The data involved ranges from names and postal addresses to customer IDs and contract numbers.
Banking data wasn’t touched. ENGIE said its internal IT systems weren’t compromised either, a point supported by both the company's notification and its statement to Infosecurity.
| Data category | Exposed |
|---|---|
| Name | Yes |
| Postal address | Yes |
| Email address | Yes |
| Telephone number | Yes |
| Customer ID | Yes |
| Contract number | Yes |
| Energy supply identifier (PDL for electricity, PCE for gas) | Yes |
| Banking information | No |
| ENGIE internal IT systems | No |
What the meter identifiers are
For electricity customers the energy supply identifier is the delivery point identifier, known as the PDL. For gas customers it is the metering and estimation point, the PCE.
Those two codes aren't passwords, and they don't move money. They mark a specific supply point, which is why a message quoting one reads as genuine to the household that recognises it.
ENGIE has declined to say whether the PDL and PCE codes on their own are enough to tie a named household to a specific supply point.
What ENGIE has and has not said
Four things remain undisclosed: the partner or platform involved, the number of customers affected, when the intrusion began, and when it was discovered.
No group has been named as responsible, and no ransomware gang has said it carried out the operation.
ENGIE described the trigger in its statement to Infosecurity.
Engie recently identified unusual data access activity within a tool used by partners as part of their customer prospecting activities and the marketing of energy offers in France
The company set out its response in the same statement.
As soon as this activity was detected, the relevant access was disabled. At the same time, Engie launched an in-depth technical investigation to understand the circumstances of the incident, accurately assess its scope by identifying customers potentially affected, and ensure that the situation was fully secured. Enhanced monitoring measures were also put in place.
The company behind the notice is one of Europe's largest energy groups, with more than 90,000 employees in 30 countries and revenue of almost €72bn ($80bn) in 2025 across gas, nuclear power and renewables.
The fraud warning in the email
ENGIE's notice to customers turns to what the leaked details could be used for.
A malicious person could use the information mentioned above to impersonate you or use your personal details to contact another organization in your name, obtain additional information, or attempt to make a payment.
It then describes the shape of the message to watch for.
Fraudulent emails may appear to come from trusted sources, such as organisations you know, in order to deceive you.
This is not ENGIE's first appearance on an extortion list. In October last year, the group Scattered LAPSUS$ Hunters named ENGIE on its leak site after compromising more than 100 Salesforce instances and claiming to have extracted over a billion records.
The earlier hit landed on ENGIE's US retail energy business, Engie Resources. The group said it accounted for 3GB of data. French customers weren't the target then.
The insurer said it had shared figures with Infosecurity showing that, from July 2025, UK and European energy and utilities clients had not reported any ransomware incidents.
- 90,000+ENGIE employees
- 30Countries where ENGIE operates
- €72bnENGIE revenue in 2025
- 0UK or European energy clients reporting ransomware since July 2025, per Resilience
Source: Infosecurity, citing ENGIE and Resilience
Resilience said recorded European claims involved only fraud or exposed customer data. In the US, ransomware makes up around 70% of losses incurred in the sector’s recorded claims.
For a French household reading the notice, the insurer's split matters: in Europe, the cost of an incident of this kind tends to arrive as a fraudulent approach rather than as a locked system.
ENGIE has not said whether the data has appeared for sale or been used in fraud attempts.
What we know
- ENGIE said attackers reached customer data through a sales tool used by some business partners.
- Names, postal addresses, email addresses, telephone numbers, customer IDs, contract numbers and energy supply identifiers were exposed.
- Banking information and ENGIE's internal IT systems were not affected.
- No group has been named and no ransomware gang has claimed responsibility.
Still unclear
- How many customers in France are affected.
- When the intrusion began and when it was discovered.
- Which partner or marketing platform was involved.
- Whether the data has been offered for sale or used in fraud attempts.
- Whether the PDL and PCE identifiers alone identify a named household's supply point.
