Engie discloses customer data breach via partner marketing tool in France

What happened

Engie has notified an undisclosed number of customers that their personal data may have been compromised, according to Infosecurity Magazine. In a statement sent to the outlet, Engie says it “recently identified unusual data access activity within a tool used by partners as part of their customer prospecting activities and the marketing of energy offers in France.”

Engie told Infosecurity Magazine that its own IT systems were not compromised. The company attributes the incident to a third-party marketing platform used by its partners, which it says threat actors compromised. Engie says it disabled the relevant access once it detected the activity, opened a technical investigation and put enhanced monitoring in place. It also says the incident is now contained.

Infosecurity Magazine cites screenshots of the customer notification that were posted to X. According to those screenshots, the data involved could include:

• Full name
• Postal and email address
• Telephone number
• Unique energy supply IDs (PCE/PDL)
• Customer ID
• Contract number

Engie says no banking data was involved.

According to Infosecurity Magazine, no extortion group had claimed responsibility at the time of writing. The outlet also notes an earlier, separate claim. In October of the previous year, the group Scattered LAPSUS$ Hunters listed Engie on its leak site and said it had obtained 3GB of data from Engie Resources, Engie’s US retail energy business. The outlet does not say the two incidents are connected.

The following details are not confirmed:

• The name of the third-party platform.
• How the platform was accessed.
• The number of affected customers.
• When the access began.

Am I affected?

• Possibly affected: Engie customers whose details were handled in the partner prospecting and marketing tool in France, according to Engie’s statement to Infosecurity Magazine. Engie says it has been identifying potentially affected customers and notifying them.
• Banking data: Engie says it was not involved.
• Scope: the number of affected people and any exposure outside France are not confirmed.

What to do now

1. If you received an Engie notification, follow its guidance. Engie urged customers to watch for fraud and phishing linked to the incident, according to Infosecurity Magazine.
2. Be wary of messages that quote your name, address, customer ID, contract number or PCE/PDL identifiers. Engie warned that “Fraudulent emails may appear to come from trusted sources, such as organisations you know, in order to deceive you.”
3. Watch for impersonation and payment requests. Engie said a malicious person could use the exposed details to impersonate you, contact another organization in your name or “attempt to make a payment.”
4. Verify any unexpected contact claiming to be from Engie or another provider by reaching the organization through a channel you already know, not through links or numbers in the message.

Sources

• Infosecurity Magazine: Energy Giant Engie Notifies Customers of Supply Chain Breach