INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Engie suffers cyber attack, customer info leaked via spear phishing

| 2026-10-28 14:01 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
A cyber attack on a system used by Engie's external business partners has exposed customer personal information, including contract numbers. The attackers gained unauthorized access to customer contact information and energy contract-related data managed by the partner company in France, affecting approximately 1 million customers. The compromised information included names, email addresses, phone numbers, customer identification numbers, and PDL and PCE numbers used to identify a customer's electricity or gas supply point. Engie stated that it had blocked the attackers' access and notified affected customers individually, informing them of the fact of personal information breaches and relevant precautions. The attack is believed to have occurred without any clear incident time, and no financial information was affected; however, ENN has cautioned its customers about potential scams and phishing attacks using their personal information.
Technical Mitigations AI-generated
• Audit (ATT&CK mitigation for Phishing): Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. • Network Intrusion Prevention (ATT&CK mitigation for Phishing): Network intrusion prevention systems and systems designed to scan and remove malicious email attachments or links can be used to block activity. • Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
FR
financefinance energyenergy
Incident Timeline
‎October 27
Threat actors used a cooperating system to target Engie's systems for customer outreach and energy product sales, resulting in the leak of customer information.
‎2026/10/28
A cyber attack by a cooperating system resulted in the leak of customer information, including contract numbers, at French energy giant Engie.
organisation ENGIE
Although ENGIE's own computer systems were not breached, the attackers gained unauthorized access to customer contact information and energy contract-related data managed by the partner company.
organisation PCE
Specifically, the PDL (Power Distribution Line Identifier) and PCE (Gas Metering Point Identifier) numbers, which are used to identify a customer's electricity or gas supply point, were also exposed.
organisation ENN
A cyber attack on ENN's system occurred without any clear incident time and the number of affected customers, as well as the name of the cooperating company that was breached, has not been disclosed.
Intelligence Sources
Dailysecu 2026-10-28