ENGIE has warned customers in France that personal data was accessed without authorisation through a sales tool used by some business partners. In notification messages, the company describes an act of cyber-malice that hit the platform used to market its electricity and gas offers.
According to the notifications, the exposed data includes names, postal and email addresses, phone numbers, customer IDs, contract numbers and supply identifiers. For electricity customers this is the delivery point identifier (PDL); for gas customers, the metering and estimation point (PCE). Banking data is not affected, and the investigation says exposure was limited to contact details and part of the contract information.
Image: newsroom.engie.com — https://newsroom.engie.com/photos/engie-logo-rgb-jpg-d42a6-ff316.html
ENGIE says its internal IT systems were not compromised. A spokesperson said the company has blocked the attackers' access, notified the relevant authorities and contacted affected customers. The partner or platform involved, the number of customers affected, when the intrusion began and when it was discovered have not been disclosed.
Although no financial data is included, the exposed information could support impersonation scams. In October, Minister Piantedosi stated that Revolut should have verified the government request after the delivery of data belonging to 680 customers to a PEC email address. Someone with accurate details about a customer may try to persuade them to share more data or make payments. A contract number alone does not prove that a caller is legitimate; it only shows that the person has access to an exposed record.
Image: denodo.com — https://www.denodo.com/en/solutions/by-industry/energy-and-utility
The company asks customers to be wary of unexpected requests for payments, passwords or personal data, and to verify them using official contact details obtained independently. Experts advise accessing services only through the official website or app, not through links received by email. No ransomware group has claimed the attack, and ENGIE has not attributed it to any specific group.
No comments yet. Be the first!