ENGIE's breach took no card numbers. It took the one number that makes a scam call sound real.

ENGIE has confirmed it: attackers reached a tool that some of its partners use to market energy offers, pulled customer data out of it, and have since been locked out. The company says its own internal IT systems were never compromised. It has not said how many people are affected, has not named the partner or the tool, and the exposure is limited to customers in France. Some of them received the notification email at the start of October, well before any of this was reported widely.

What went: first and last name, postal address, email address, telephone number, customer identifier, contract number, and the PDL for electricity or the PCE for gas. No banking data, which ENGIE was understandably keen to lead with.

That last item is worth a moment. A PDL is the reference for the exact point at which electricity enters your home. Nobody memorises it and most people have never gone looking for it, which is exactly why someone who reads yours back to you, with your contract number alongside, sounds like the energy company rather than a stranger with a spreadsheet. Expect calls and emails about a tariff review, a refund on an overpayment, or an urgent meter appointment, and expect them to open with details that only ENGIE ought to know.

The rule that survives all of this is dull and absolute: nobody legitimate needs your bank details or a payment during a call you did not place, however much they already know about you. Hang up, find the number printed on a bill, ring that. And if you want to see which of your email addresses are already circulating on lists of this kind, Tendvane's Privacy and accounts check looks each one up against known breaches.