One of the world’s largest natural gas suppliers has notified an undisclosed number of customers that their personal data may have been compromised in a recent breach.
French multinational Engie employs over 90,000 people across 30 countries, supplying gas, nuclear power, and renewables. Its revenue in 2025 was almost €72bn ($80bn).
According to screenshots of the customer notification posted to X, the compromised data could include: full name, postal and email address, telephone number, unique IDs for energy supply (PCE/PDL), customer ID, and contract number.
The firm confirmed that no banking data was involved in the breach.
Engie urged customers to be on the lookout for potential fraud and phishing stemming from the incident.
“A malicious person could use the information mentioned above to impersonate you or use your personal details to contact another organization in your name, obtain additional information, or attempt to make a payment,” it warned. “Fraudulent emails may appear to come from trusted sources, such as organisations you know, in order to deceive you.”
According to a statement from the firm sent to Infosecurity, its own IT systems weren’t compromised. Engie blamed a third-party marketing platform used by its partners which was then compromised by threat actors.
“Engie recently identified unusual data access activity within a tool used by partners as part of their customer prospecting activities and the marketing of energy offers in France,” it explained.
“As soon as this activity was detected, the relevant access was disabled. At the same time, Engie launched an in-depth technical investigation to understand the circumstances of the incident, accurately assess its scope by identifying customers potentially affected, and ensure that the situation was fully secured. Enhanced monitoring measures were also put in place.”
No Group Has Claimed Responsibility
At the time of writing, no extortion group had admitted responsibility for the breach, which Engie said is now contained.
However, in October last year, extortion group Scattered LAPSUS$ Hunters listed the firm on its leak site, after compromising over 100 Salesforce instances and claiming to have extracted more than one billion records.
In that incident, Engie’s US retail energy business Engie Resources was the victim, with the group claiming to have obtained 3GB of data.
According to claims data from insurer Resilience shared with Infosecurity, no UK or European energy and utilities clients have reported ransomware since July 2025.
European claims with a recorded cost involved only fraud or exposed customer data. That contrasts with the US where ransomware comprises around 70% of incurred losses across claims on record in the sector, Resilience said.