ENGIE says partner marketing tool exposed French customer data

ENGIE says a partner sales tool exposed some French customers’ personal and contract data; banking data and its own IT were not affected.

French energy company ENGIE notified an undisclosed number of customers in France that attackers accessed a third-party marketing and sales tool used by partners to prospect customers and market electricity and gas offers. ENGIE said it disabled the relevant access, blocked the attackers and contained the incident, and that its internal IT systems were not compromised. Exposed fields can include names, postal and email addresses, phone numbers, customer IDs, contract numbers, and energy supply identifiers: electricity delivery-point IDs (PDL) and gas metering and estimation points (PCE). No banking data was affected. The partner, customer count and intrusion timeline were not disclosed, ENGIE did not name an attacker, and no extortion group had claimed the breach. Authorities were notified and affected customers were contacted.