For: ENGIE customers in France (electricity and gas, individuals), and anyone who sells energy through partners. This article is based on ENGIE's email to customers and statements reported by several outlets, and does not cover attack techniques.
Developing: this article will be updated as the organisation publishes more
As of October 30, 2026Not yet known
- Number of customers affected
- Name of the partner and tool, and how access was gained
- Dates of the intrusion
- Whether the data has been published or misused
- Whether ENGIE publishes a notice on its own website
We did not find a notice about this incident on ENGIE's own website (checked October 30). The facts below come from the customer email and ENGIE's statements as reported by BleepingComputer, Génération NT, Univers Freebox and Selectra, which agree on the items below.
What ENGIE customers should do today
Treat calls that quote your contract or meter number as unproven
The exposed items include your customer ID, contract number and PDL or PCE. A caller who quotes them is not proof the caller is ENGIE. The sales and "overpayment refund" calls built on such details usually ask for an IBAN or a card number "to finalise". Give neither.
ENGIE's own advice page says its advisors prefer to call about billing or consumption problems rather than send a text or email, and that no advisor or official email will ask for your password.
Hang up and call back on a number you trust
If in doubt, hang up and call an ENGIE advisor on 09 69 324 324, the non-premium-rate number listed on ENGIE's advice page, or on the number printed on your bill. Do not use a number the caller gave you. Do not read out any code sent to your phone.
Do not click links in unexpected messages
Email addresses and phone numbers were exposed, so fake "your account is compromised" emails and texts that imitate the real alert are possible. ENGIE says it never asks for passwords or bank details by message. Type the ENGIE address yourself or use the app (how to spot them: What is phishing?).
Check your customer account for changes you did not ask for
A PDL or PCE number is needed to set up or move an energy contract, so someone holding it and your details might try to start one in your name. This is a general risk, and ENGIE has not said it happened. Look for contracts, bills or changes you do not recognise, and ask your supplier if anything looks wrong.
Report scam calls and texts
Selectra's guidance is to report unwanted calls or texts to the French 33700 service. If you were tricked into giving card or bank details, contact your bank straight away, as ENGIE's advice page also says.
What happened (per ENGIE, as reported)
The following is based on ENGIE's email to customers and its statements reported by the outlets in Sources. The date of the intrusion is not disclosed.
Late October 2026
ENGIE begins emailing affected customers in France. The reports we checked do not give the date of the email.October 27
BleepingComputer publishes ENGIE's statement that its internal systems were not compromised and that it cut the attackers' access to the platform.As of October 30
No further notice found. ENGIE has not said how many customers are affected.
- Where it happened
- A tool used by some of its partners to prospect for customers and promote energy offers. ENGIE says its own IT systems were not compromised
- Data exposed (per reports citing the customer email)
- First and last names, postal and email addresses, phone numbers, PDL (electricity) or PCE (gas), customer ID, contract number
- Not affected, per ENGIE
- Banking data
- Who is concerned
- Customers in France, each informed individually
- Actions taken
- Cut the attackers' access to the platform; informed the competent authorities; contacted affected customers with advice on fraud and phishing
- Attribution
- No group has claimed it, and none has been named
What is known and what is not
Status as of October 30, 2026. When ENGIE publishes more, we will update the status column.
| Item | What ENGIE has said | Status |
|---|---|---|
| Names, postal and email addresses, phone numbers | Exposed (per reports citing the customer email) | Confirmed (ENGIE, as reported) |
| PDL or PCE, customer ID, contract number | Exposed (per reports citing the customer email) | Confirmed (ENGIE, as reported) |
| Banking data, including IBAN | No banking data is affected | Not included (ENGIE) |
| Passwords | Not listed by ENGIE | Not stated |
| Where it happened | A partners' tool for prospecting and promoting offers; ENGIE's internal systems not compromised | Confirmed (ENGIE, as reported) |
| Customers concerned | France only; each informed individually | Confirmed (ENGIE, as reported) |
| Authorities | Informed; one outlet (Génération NT) says the competent authorities including the CNIL, without making clear whether those are ENGIE's words; other reports name none | Confirmed (ENGIE, as reported) |
| Number of customers affected | Not given | Under investigation |
| Dates of the intrusion | Not given | Not stated |
| Publication or misuse of the data | No claim or publication reported | Not stated |
How to read this: 'not stated' is not 'did not happen'
No outlet we checked reported the data being published or used, and none was quoted from ENGIE saying so either way. Until ENGIE says more, assume calls and messages using these details are possible.
What these items can be used for
In general, the following combinations can be misused as described. This does not mean it has happened in this case.
- Name + phone + contract number + meter reference: a caller can sound like ENGIE and invent an overpayment, a billing correction or an urgent visit
- Email address + name + customer ID: lets someone write a convincing email that copies ENGIE's alert and sends you to a fake login page
- Meter reference + address: identifies your supply point, which is the reference used when an energy contract is set up or moved
For companies that give partners access to customer data
ENGIE says the exposure came from a tool used by some of its partners, not from its own systems, and it has not named the partner or said how access was gained. This section does not assess ENGIE's or its partners' measures. These are general checks for any company that shares customer data with sales partners.
Notice: data was reached through a partners' tool
↓→
Which fields does the tool really need to show?
→ Hide contract and meter numbers unless a task requires them
Notice: "unusual data access" was detected
↓→
Would you see unusual volume per partner account?
→ Set a daily record limit per partner and alert at 80%
Notice: partner not named, count not given
↓→
Can you list who can see which customers?
→ Keep access logs so a count can be given quickly
Show partners only the fields their task needs
A sales tool rarely needs a full contract number and a meter reference next to a name and phone number. Mask or leave out fields that a call script does not use, so a breach of the tool exposes less.
Put a daily limit on records per partner account and alert at 80%
Measure at the application that serves the data, per partner login. A limit such as a set number of customer records per account per day, with an alert to your security contact at 80%, turns "unusual access" into something you notice the same day.
Keep access logs that say who viewed which customers
Being able to state how many customers were reached, and which, is what lets a company tell people exactly what was exposed. Keep partner access logs for at least the period your regulator expects.
Sources (public record)
The facts in this article are based on the public information below. We do not speculate on undisclosed intrusion routes or techniques. ENGIE's email to customers is quoted by the outlets below; we did not find the notice on ENGIE's own website.
- BleepingComputer, "Energy giant ENGIE discloses data breach affecting customers" (October 27, 2026) — bleepingcomputer.com
- Génération NT, "Engie confirme une fuite de données touchant ses clients en France" (October 28, 2026, French) — generation-nt.com
- Univers Freebox, "Engie victime d'une nouvelle fuite de données : des clients français concernés, attention aux arnaques" (October 28, 2026, French) — universfreebox.com
- Selectra, article on the leak and fake advisor calls (October 27, 2026, French) — selectra.info
- ENGIE, "Comment éviter le phishing et les arnaques sous le nom d'ENGIE" (general advice page, checked October 30, 2026, French) — particuliers.engie.fr
Update history
2026-10-30: First version, based on ENGIE's customer email and statements as reported by the outlets above (checked October 30), and ENGIE's general advice page. We will update this article if ENGIE publishes a notice or figures.
Read next
- Scams that follow a breach: What is phishing? / How to check if your password leaked
- Spoofed senders: Email spoofing, SPF, DKIM and DMARC
- Other 2026 incidents: Data breaches and cyberattacks in 2026