# Engie Notifies French Customers of Supply Chain Breach via Third-Party Partner Marketing Platform

> Engie, the French multinational energy supplier, notified customers in France after unusual data access was detected in a marketing/sales tool used by its commercial partners for customer prospecting. Access was cut off; exposed data includes contact details, PDL/PCE energy meter IDs, customer IDs and contract numbers. Banking data and Engie's internal IT systems were not affected.

- **Published:** 2026-10-28T23:11:16Z
- **Last reviewed:** 2026-10-28T23:11:16Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4681
- **ID:** TL-2026-4681
- **Severity:** MEDIUM
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On or around 23-27 October 2026, Engie disclosed that it had recently identified unusual data access activity within a tool used by certain of its business partners to market and prospect for Engie energy offers. Engie's public statements, as relayed by Infosecurity Magazine, BleepingComputer and Fuites Infos, say the incident occurred on a partner's marketing/sales platform and that Engie's own internal IT systems were not compromised. Engie disabled access to the tool on discovery, launched an in-depth technical investigation, put enhanced monitoring in place, and described the incident as contained. It also notified the relevant authorities and informed each affected customer individually.

Potentially exposed data covers customer identity and contact information (surname, first name, postal address, email address, telephone number) and energy contract data: the electricity delivery point (PDL) or gas metering point (PCE) identifier, the Engie customer ID and the contract number. Engie states that no banking data is affected. Scope is limited to customers in France. Engie has not disclosed the number of affected customers, the name of the partner or tool, the exact intrusion and discovery dates, the initial access vector, or the exfiltration method.

No threat actor, extortion group or ransomware crew has claimed responsibility as of the reporting, and there is no public indication that the data has been published or sold. No malware, CVEs, network IOCs or infrastructure details have been published, so no attribution is made here. Infosecurity Magazine notes that Engie Resources (its US retail arm) appeared on the Scattered LAPSUS$ Hunters Salesforce leak site in October 2025, and that Engie suffered an earlier third-party-provider breach in August 2023 (monespaceprime.engie.fr, about 110,000 users). Neither is linked to this incident by any source; they are recorded as context only.

The main downstream risk is targeted fraud and phishing. The exposed combination of name, contact details, PDL/PCE and contract/customer identifiers lets attackers craft convincing impersonation messages. Engie and French guidance advise customers to treat emails citing genuine account details with suspicion, to avoid clicking links in emails and use official sites or apps instead, to refuse unsolicited requests for SMS codes, passwords or banking details, and to seek help via cybermalveillance.gouv.fr.

## MITRE ATT&CK

- T1199 Trusted Relationship
- T1213 Data from Information Repositories
- T1589 Gather Victim Identity Information
- T1566 Phishing
- T1598 Phishing for Information

## Sources

- [Energy Giant Engie Notifies Customers of Supply Chain Breach](https://www.infosecurity-magazine.com/news/energy-giant-engie-supply-chain/)
- [Energy giant ENGIE discloses data breach affecting customers](https://www.bleepingcomputer.com/news/security/energy-giant-engie-discloses-data-breach-affecting-customers/)
- [ENGIE : fuite de données via un outil de ses partenaires commerciaux](https://fuitesinfos.fr/article/2026-10-23-engie)
- [Engie confirms customer data breach via marketing platform](https://www.scworld.com/brief/engie-confirms-customer-data-breach-via-marketing-platform)
- [Engie confirme une fuite de données touchant ses clients en France](https://www.generation-nt.com/actualites/engie-cyberattaque-fuite-donnees-clients-france-2083572)
- [Scattered Lapsus$ Hunters (context: Oct 2025 Salesforce extortion campaign, Engie Resources listed)](https://en.wikipedia.org/wiki/Scattered_Lapsus$_Hunters)
- [Scattered Lapsus$ Hunters leak first wave of Salesforce victim data](https://cyberinsider.com/scattered-lapsus-hunters-leak-first-wave-of-salesforce-victim-data/)
- [Le site des primes d'énergie d'Engie piraté (context: Aug 2023 provider-managed site breach)](https://www.lemondeinformatique.fr/actualites/lire-le-site-des-primes-d-energie-d-engie-pirate-91422.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4681