ENGIE reports a customer data leak at a partner, without saying how many or which one

The email is signed by ENGIE, and it is not a sales offer. According to the specialist site Fuites Infos, which published a screenshot during the night of October 23-24, the energy supplier is informing customers that their personal data has been accessed without authorization. ENGIE attributes this to an act of cybermalice against a tool used by some of its sales partners, those who sell its electricity and gas offers.

According to the notification, the data involved includes first and last name, postal address, email address, phone number, customer ID, contract number and meter reference: the delivery point for electricity, and the metering and estimation point for gas. ENGIE states that bank details were not affected.

How many customers, and which partners?

ENGIE doesn't say. The supplier names neither the partners nor the tool that was attacked, does not give the number of customers affected, and dates neither the intrusion nor its discovery. No hacker claim was known at this stage, according to Fuites Infos.

The scenario is not new for the group. In 2023, Next reported, citing Numerama, that a hacker claimed to have obtained the data of more than 110,000 customers after an attack on an ENGIE contractor, via the site monespaceprime.engie.fr. The weak link was already a third party, as with the leak affecting hotels through the Misterbooking booking software.

Why scammers want this data

Taken one by one, these pieces of information seem harmless. Combined, they make it possible to write a very convincing fake message: a scammer who knows your name, your contract number and your meter reference can pose as ENGIE, or as a competitor, and talk to you about an “adjustment,” a refund or a change of plan. This is the most likely follow-up to this type of leak.

Best practices

If you are an ENGIE customer, and especially if you received this email:

• be wary of emails, texts or calls that claim to come from ENGIE or a partner and demand payment or information, even if they quote your real references;
• never log in to your customer account through a link you received: go through the official website or app;
• never share a code received by text, a password or your bank details with someone who contacts you;
• forward suspicious texts to 33700, and get free help at cybermalveillance.gouv.fr (the French government's cybercrime victim assistance platform) if you think you've been tricked.

It remains to be seen how many customers received this message, and which other suppliers use the same sales tool. If other energy companies work with these partners, their customers could be the next to be notified.