ENGIE data breach: French customers’ contract details exposed via partner tool

If you get electricity or gas from ENGIE in France, be careful with any unexpected call, text or email that already knows your contract number. ENGIE has confirmed that someone accessed customer data through a tool its partners use to sell energy offers, exposing contact details and contract information for an undisclosed number of French customers.¹

Reporting checked October 27, 2026.

Too long; didn’t read?

• Exposed: name, postal address, email, phone number, electricity delivery point (PDL) or gas metering point (PCE), customer ID and contract number.¹
• ENGIE says no banking data was affected and its own internal systems were not compromised.¹
• ENGIE has contacted affected customers and notified the authorities. It has not said how many people are affected.¹
• If “ENGIE” calls you, hang up and call back on the number printed on your bill.

What ENGIE says happened

An ENGIE spokesperson told BleepingComputer on October 27 that the company “recently identified unusual data access activity within a tool used by partners” for finding customers and marketing energy offers, and that “ENGIE’s internal IT systems were not compromised.” The company says it cut off the access, that only customers in France are affected, and that “No banking data is affected.” It has notified the relevant authorities and written to affected customers.¹

French breach-tracking site Fuites Infos reported on October 24 that customers had received an email describing the incident as a deliberate cyberattack on a partner’s sales tool. The email does not name the partner or say when the access happened.² As of October 27, no ransomware or extortion group had claimed the attack.¹

Why a contract number makes scams more convincing

The PDL or PCE number identifies your electricity or gas meter, and together with your customer ID and contract number it is the kind of detail only your supplier should know. A scammer who can read those out to you sounds exactly like a real ENGIE adviser. ENGIE’s own email to customers warns about people using these details to ask for more information or to push a payment.²

Since bank details were not taken, a fraudster still needs to talk you into something: paying a “bill”, reading out a code sent by text, giving an IBAN or card number for a “refund”, or signing up to a new contract. Energy comparison site Selectra advises always calling back on the number printed on your bill, not a number the caller gives you.³

What you can do

• Hang up and call back yourself on the number on your ENGIE bill or in your customer account.³
• Never give bank details, card numbers, codes or passwords to someone who contacts you out of the blue. France’s official cybercrime assistance service says no serious company will ask for banking data or passwords by message or phone.⁴
• Report suspicious texts by forwarding them to 33700, a free service, and unwanted calls at 33700.fr.^{4, 5}
• If you already shared payment details, contact your bank immediately to block the card or payment, and keep the message.⁴
• Check your bank statements for direct debits you don’t recognise. The Banque de France says fraudsters use fake SEPA direct-debit mandates, and that you can dispute an unauthorised debit with your bank, at the latest 13 months after it was taken.⁶

Sources

1. BleepingComputer, October 27, 2026: Energy giant ENGIE discloses data breach affecting customers
2. Fuites Infos, October 24, 2026: ENGIE: data leak via a tool used by its commercial partners (in French)
3. Selectra, October 27, 2026: An “ENGIE adviser” quotes your contract number? What to do before you answer (in French)
4. Cybermalveillance.gouv.fr: What to do about phishing (in French)
5. 33700: Platform for reporting unwanted texts and calls (in French)
6. Banque de France: FAQ on SEPA direct debits (in French)