French energy group ENGIE — one of the world's largest power and natural-gas providers, with more than 90,000 employees, operations in 30 countries and €71.9 billion in revenue last year — has confirmed that attackers stole customer data after breaching a marketing platform used by its business partners. A spokesperson told BleepingComputer that ENGIE's internal IT systems were not compromised: the company identified unusual data-access activity within a partner tool used for customer prospecting and marketing energy offers, cut off the attackers' access, notified the relevant authorities and contacted affected customers. The incident is limited to customers in France, and the data is confined to contact details and certain information relating to their energy contracts — no banking data is affected. ENGIE has not disclosed how many customers are impacted. For a critical-infrastructure operator that also supplies energy to businesses, the breach illustrates the exposure that flows down the partner channel even when core industrial systems remain untouched.

• Source article