Fransuz energetika giganti ENGIE — dunyodagi eng yirik elektr va tabiiy gaz ta'minotchilaridan biri — biznes hamkorlari foydalanadigan marketing platformasi buzilgandan so'ng hujumchilar mijoz ma'lumotlarini o'g'irlaganini tasdiqladi.
ENGIE 30 ta mamlakatda qayta tiklanadigan energiya, infratuzilma va mijozlarga energiya yetkazib berish sohalarida faoliyat yuritadi, 90 000 dan ortiq xodimni ish bilan ta'minlaydi va o'tgan yili €71,9 milliard daromad qayd etgan.
ENGIE vakili BleepingComputer'ga aytishicha, kompaniya hujumchilarning buzilgan platformaga kirishini to'xtatgan va ular kompaniyaning ichki tizimlarini buzmagan.
"ENGIE'ning ichki IT tizimlari buzilmagan. ENGIE yaqinda hamkorlar tomonidan mijozlar bilan ishlash va energiya takliflarini marketing qilish uchun ishlatiladigan vosita ichida g'ayrioddiy ma'lumotlarga kirish faoliyatini aniqladi", — dedi vakil.
ENGIE vakili qancha mijoz ta'sirlanganini aytmadi, lekin BleepingComputer'ga hodisa faqat Fransiyadagi mijozlar bilan cheklanganini bildirdi.
Hujumdan beri ENGIE tegishli organlarni xabardor qilgan va ta'sirlangan mijozlarga buzilish haqida ma'lumot berish uchun ular bilan bog'langan.
"Hozirgacha o'tkazilgan tekshiruvlar shuni ko'rsatadiki, tegishli ma'lumotlar mijozlarning aloqa ma'lumotlari va ularning energiya shartnomalariga oid ayrim ma'lumotlar bilan cheklangan. Hech qanday bank ma'lumotlari ta'sirlanmagan", — deb aytdi ENGIE BleepingComputer'ga.
"Shaffoflik manfaatida ENGIE har bir tegishli mijozni alohida xabardor qildi va ularga potentsial firibgarlik yoki fishing urinishlaridan himoyalanish uchun ehtiyot choralarini eslatdi."
Kompaniya hujumda qaysi mijoz ma'lumotlari o'g'irlanganini aniq aytmagan bo'lsa-da, ta'sirlangan mijozlarga yuborilgan buzilish xabarnomalarida tahdidchilar ularning ismi va familiyasi, pochta manzili, elektron pochta manzili, telefon raqami, Yetkazib berish nuqtasi (PDL) yoki O'lchash va baholash nuqtasi (PCE), mijoz ID raqami va shartnoma raqamiga kirish huquqiga ega bo'lganini aytgan.
ENGIE hujumni ma'lum bir tahdid guruhiga bog'lamadi va nashr etilishidan oldin hech qanday ransomware operatsiyasi yoki tovlamachilik guruhi ENGIE buzilishini o'z zimmasiga olmagan.
Bir yil oldin Scattered LAPSUS$ Hunters tovlamachilik guruhi ham ENGIE North America'ning chakana energiya yetkazib berish sho'ba korxonasi — Engie Records'ning Salesforce nusxasini buzgan deb da'vo qilinganidan so'ng o'g'irlangan yozuvlarni e'lon qilgan edi.
Hujumchilar haqiqiy hisob ma'lumotlariga ega bo'lgach, ularning harakatlarining faqat 37% to'xtatiladi
Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy hisob ma'lumotlaridan foydalangach, oldini olish keskin pasayadi.
Blue Report 2026 mijozlar ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha mudofaa texnikalarini o'lchaydi.
Hisobotni oling
French energy giant ENGIE, one of the world's largest power and natural gas providers, confirmed that attackers stole customer data after breaching a marketing platform used by business partners.
ENGIE operates in renewable energy, infrastructure, and customer energy supply in 30 countries, employs over 90,000 people, and reported €71.9 billion in revenue last year.
An ENGIE spokesperson told BleepingComputer that it cut off the attackers' access to the compromised platform and that they didn't breach the company's internal systems.
"ENGIE's internal IT systems were not compromised. ENGIE recently identified unusual data access activity within a tool used by partners as part of their customer prospecting activities and the marketing of energy offers," the spokesperson said.
The ENGIE spokesperson didn't say how many customers were affected, but told BleepingComputer the incident is limited to customers in France.
Since the attack, ENGIE has notified relevant authorities and contacted affected customers to inform them of the breach.
"The investigations conducted to date indicate that the data concerned is limited to customers' contact details and certain information relating to their energy contracts. No banking data is affected," ENGIE told BleepingComputer.
"In the interest of transparency, ENGIE individually informed each customer concerned and reminded them of the precautionary measures they should take to protect themselves against potential fraud or phishing attempts."
Although the company didn't share what customer information was stolen in the attack, it said in breach notification letterssent to affected customers that the threat actors gained access to their first and last names, mailing address, email address, phone number, Delivery Point (PDL) or Metering and Estimation Point (PCE), customer ID, and contract number.
ENGIE didn't attribute the attack to a specific threat group, and no ransomware operation or extortion gang has claimed the ENGIE breach before publication.
One year ago, the Scattered LAPSUS$ Hunters extortion group also leaked records they claimed to have stolen after allegedly breaching a Salesforce instance of Engie Records, the retail energy supply subsidiary of ENGIE North America.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report