Engie Breach

Oct 10, 2025

537,000 rows

Added on Oct 11, 2025

Data Found in the Breach

Phone Number

Name

Home Address

What happened in the Engie Breach?

DataBreach.com Team · October 10th 2025, 8:00 pm EDT

In early October 2025, ENGIE-the multinational energy company-appeared on the leak site of a group calling itself Scattered LAPSUS$ Hunters. The group alleges it exfiltrated data from ENGIE’s Salesforce environment as part of a broader 2025 campaign targeting Salesforce-connected organizations. Salesforce maintains its platform was not breached and says the attackers are exploiting victim organizations-primarily via social-engineering and voice-phishing-rather than a Salesforce vulnerability.

On October 3, 2025, Scattered LAPSUS$ Hunters launched their leak site and posted teaser samples for numerous brands, including a limited preview attributed to ENGIE. However, the full, unredacted data set was subsequently leaked on October 10'th.

Breach Unveiled

October 3, 2025: Scattered LAPSUS$ Hunters list ENGIE on their leak site and publish a limited preview.
October 10, 2025: The group's deadline for "full" data releases passes and a data dump is published.

Status and Verification

At this stage, the ENGIE incident is not confirmed. A full corpus of data attributed to the company has been posted publicly by the threat actor and the company has not yet responded to the claims.

About the Threat Actor

Scattered LAPSUS$ Hunters is a 2025 extortion alliance blending tactics associated with ShinyHunters, Scattered Spider, and LAPSUS$. The group runs a public leak site with countdowns and ransom demands aimed at Salesforce-using organizations. The FBI has issued an alert linking this campaign to two clusters: UNC6040 and UNC6395. The threat actor's access is primarily tied to social-engineering/vishing and the misuse of client-side tools, not a core Salesforce platform exploit.