For awareness Medium Awareness
ENGIE confirms attackers stole customer data from marketing platform
BleepingComputerENGIE · energy
What happened. French energy provider ENGIE confirmed that attackers stole customer data after breaching a marketing platform used by business partners. The report does not state any effect on operations.
Who is affected. ENGIE customers whose data was held on the marketing platform used by business partners. The source gives no further detail on who is affected.
What to do. No action is named. If you run similar equipment, check whether the same technique would work against your site.
When to act. For awareness: no sign it reaches your site
Editor's reading
ForIT securityleadership
- Purdue level
- L4
Why: The breach hit a business marketing platform used by partners, which is enterprise IT (L4) rather than plant control systems.
- Are you exposed?
Check whether your organisation is an ENGIE customer or partner, or shares data with the same marketing platform.
- If you cannot fix it yet
- Review which third-party marketing or partner platforms hold customer or staff data, and limit the data they receive.
- Require multi-factor authentication on partner platform accounts.
- Watch for
- Phishing emails that use ENGIE or energy-supplier branding and refer to customer account details.
- Unusual logons or bulk data exports from partner platform accounts.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: BleepingComputer (opens bleepingcomputer.com)
More on Energy and power