French energy group ENGIE has confirmed that attackers accessed and stole customer data after breaching a tool its business partners use to prospect customers and sell energy contracts in France. The company said its own internal IT systems were not compromised and that it has cut off the attackers’ access to the platform.
ENGIE confirmed the incident in a statement this week, after customer notification emails began circulating in France late last week. The company has not said how many customers are affected, which partner or vendor runs the compromised tool, or when the intrusion started.
Unusual data access in a partner sales tool
According to ENGIE, its teams “recently identified unusual data access activity within a tool used by partners as part of their customer prospecting activities and the marketing of energy offers.” ENGIE does not sell door to door itself and relies on accredited sales partners to market its electricity and gas offers, a point it makes in its own anti-phishing guidance. Those partners need access to customer and contract details to sign people up, which is what made the tool a valuable target.
The company said the incident is limited to customers in France. It has notified the relevant authorities and individually informed each affected customer, though it has not named the regulator. In France, organizations must report personal data breaches to the CNIL within 72 hours of becoming aware of them under GDPR.
What the notification letters list
ENGIE’s public statement describes the stolen information as “limited to customers’ contact details and certain information relating to their energy contracts” and says no banking data is affected. The notification emails sent to customers are more specific and list the following data:
- First and last names
- Postal addresses
- Email addresses
- Phone numbers
- Delivery Point (
PDL) numbers for electricity or Metering and Estimation Point (PCE) numbers for gas - Customer IDs
- Contract numbers
The letters describe the event as an act of cyber malice affecting the partner tool. ENGIE has not said whether the attackers only viewed the records or exported them in bulk.
Why meter and contract numbers raise the fraud risk
A PDL is the 14-digit identifier that pinpoints an electricity supply point on the grid, and a PCE does the same job for gas. Customers are often asked for these references when they sign a contract or switch suppliers. On their own, they do not unlock an ENGIE customer account or give control of a meter.
Paired with a name, home address, phone number and real contract number, though, they give scammers exactly the details a fake “ENGIE advisor” needs to sound legitimate. A caller who can quote a customer’s contract and meter reference can then push for an IBAN, a one-time SMS code or a payment for a supposed tariff change.
ENGIE said it reminded affected customers of the precautions to take against fraud and phishing. The company says it will never ask for a password or bank details by email, SMS or phone. Customers can report suspicious messages using the steps on ENGIE’s fraud attempt page, and French victims of scams can get help through Cybermalveillance.gouv.fr.
A second ENGIE customer notice this month
This is not the first data incident ENGIE has disclosed to French customers in October. On October 2, 2026, the company emailed some residential customers to say that one of its providers, a supplier of communication and customer interaction tools, had suffered a cyberattack. That notice listed names, contract numbers, phone numbers, email and postal addresses, and excerpts of exchanges with customer service advisors. ENGIE said at the time that it had notified the CNIL.
The newer notice describes a different kind of tool, one used by sales partners, and adds PDL and PCE numbers to the exposed data. ENGIE has not said whether the 2 events are linked.
Energy suppliers have become a steady target for customer data theft, with CenterPoint Energy and Origin Energy both confirming breaches of customer records. France has also seen a run of large exposures, including the France Titres breach.
No group has claimed the attack
ENGIE has not attributed the breach to any threat actor, and no ransomware or extortion group had publicly claimed it at time of publication. ENGIE also had not posted a dedicated notice about the incident on its customer websites at time of publication.
Customers who received the notification should treat any call, text or email that references their contract or meter number with suspicion, hang up and contact ENGIE through the numbers listed on their bill or in their customer account.
