Short answer
ENGIE says unusual data access in a marketing tool used by its commercial partners let attackers take contact details and contract references of some French customers. It says its internal IT systems were not compromised and no banking data was affected. Reports of the breach began around 27 October 2026.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | ENGIE |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Energy utility |
| Country | France |
| Detected | 2026-10-23 |
| Disclosed | 2026-10-27 |
| People or records affected | Some customers in France; ENGIE has not given a number |
What data was exposed
- First and last names
- Postal and email addresses and phone numbers
- Electricity delivery point (PDL) or gas metering point (PCE) references
- Customer ID and contract number
What happened
ENGIE, the French energy group, told customers in late October 2026 that attackers had stolen some of their personal data. The company says it detected unusual data access in a tool used by its commercial partners to prospect customers and market its electricity and gas offers. It says it cut off the access.
BleepingComputer reported the breach on 27 October, and LeMondeInformatique followed on 29 October. ENGIE says its internal IT systems were not compromised. It has not named the partner or platform involved, has not explained how the intrusion happened and has not given a number of affected customers. A spokesperson said the incident is limited to customers in France.
What was exposed
Breach notification letters seen by BleepingComputer list first and last names, postal and email addresses, phone numbers, the electricity delivery point (PDL) or gas metering point (PCE) reference, customer ID and contract number. ENGIE says the data is limited to contact details and some contract information and that no banking data is affected.
Attribution
No ransomware or extortion group had claimed the breach in the coverage we checked, and ENGIE has not blamed anyone. BleepingComputer noted a separate, earlier claim by a different group about an ENGIE North America subsidiary. That claim concerned a different company system and is not linked to this incident.
Why the data matters
A PDL or PCE number is tied to your physical meter, and a contract number looks like inside knowledge. A scammer who quotes both can pass as an ENGIE advisor or technician. The usual follow-ups are calls about an invoice anomaly, an offer of a refund, an urgent meter check or a pitch to switch supplier.
ENGIE urges customers to stay vigilant. It reminds them that it does not ask for a password or bank details by message or phone call, and French reporting adds the advice to check where a message comes from and avoid suspicious links.
What to do
If you are an ENGIE customer in France, check any contact through the details on your bill, never through a number or link someone gives you. Do not pay anything on the strength of a call or text. If you receive a notification letter, keep it.
Related reading: our data breach checklist, the guide to phishing messages and the guide to urgent payment scams. Another recent French story is the cyberattack on Strasbourg’s CTS.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phone calls from fake ENGIE advisors or technicians who quote your PDL or PCE number and contract number to sound genuine.
- Phishing emails or texts about an invoice, a refund or a contract change that ask for payment or bank details.
- Doorstep or telephone sales pitches that use your real supplier details to push a switch of energy provider.
What to do if you are affected
- 01Treat any unexpected call, email or text about your energy contract with suspicion, even if the sender knows your customer number or PDL/PCE.
- 02Use only the contact details on your ENGIE bill or the official ENGIE site to check a request.
- 03Never give a password or bank details by phone, email or text. ENGIE says it does not ask for them that way.
- 04Do not click links in messages about invoices or refunds. Log in to your customer account by typing the address yourself.
- 05If a caller pressures you to change supplier or sign something, hang up and call ENGIE back on a known number.
Frequently asked questions
How did the ENGIE breach happen?
ENGIE says it spotted unusual data access in a tool that its commercial partners use to prospect and promote energy offers. It has not said how the intruders got in or named the partner.
Was my bank information stolen?
ENGIE states that no banking data is affected, and that its internal IT systems were not compromised. The exposed fields are contact and contract details.
How many customers are affected?
ENGIE has not given a number. A spokesperson told BleepingComputer the incident is limited to customers in France, and French media say ENGIE contacted only some customers.
Has a hacking group claimed the attack?
Not in the coverage we checked. BleepingComputer reported that no ransomware or extortion group had claimed it, and ENGIE has not attributed it.
Why are PDL and PCE numbers a risk?
They identify your electricity meter point or gas metering point. A caller who quotes them can sound like a real ENGIE advisor, which makes fake-technician and fake-billing calls more convincing.
Sources
- Energy giant ENGIE discloses data breach affecting customers, BleepingComputer, 2026-10-27
- Une cyberattaque expose les donnees personnelles de clients d'Engie, LeMondeInformatique, 2026-10-29
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.