energy

ENGIE Customer Data Breach (France): Contact Details and Contract Numbers Exposed via a Partner Sales Tool, No Bank Data, and What Customers Should Do

ENGIE, the French energy supplier, began emailing customers in France in late October 2026 to say that an attack (wording reported as an act of cyber-malice) hit a tool used by some of its partners to prospect for customers and sell its offers. According to reports citing ENGIE's customer email (ENGIE's statement to BleepingComputer did not itself list the items), the exposed data is first and last names, postal and email addresses, phone numbers, the electricity delivery point (PDL) or gas metering point (PCE) reference, customer ID and contract number. ENGIE says no banking data is affected, that its own IT systems were not compromised, that it cut off the attackers' access to the platform, and that it informed the authorities. The number of customers affected and the partner involved have not been disclosed. We found no notice about this on ENGIE's own website, so this article relies on ENGIE's statements as reported by several outlets. This site's take: do not give an IBAN, card number or code to anyone who calls or writes citing your contract or meter number, and hang up and call the number on your bill.