French energy company ENGIE confirmed that attackers stole customer data, BleepingComputer reported on 27 October. The attackers got into a marketing platform that ENGIE's business partners use to find customers and sell energy offers. An ENGIE spokesperson said the company cut off their access and that its own internal IT systems were not compromised. ENGIE says it notified the relevant authorities and individually informed each affected customer.
ENGIE says its checks so far show only contact details and some contract data were taken. It says no banking data is affected. It also says only customers in France are involved, but it gave no count. BleepingComputer said letters to customers list names, addresses, email, phone numbers, meter point IDs, customer IDs and contract numbers. ENGIE has not said how the attackers got in. It named no group, and no gang had claimed the breach by publication.
A partner prospecting tool lets outside sellers find people to contact, so it holds contact and contract data. Those fields suit phishing, since a caller who knows your name, address and contract number sounds real. Firms that share customer records should ask which partners can query them, whether access is limited and logged, and how fast odd access is noticed.