Marketing Platform Breach: Which Control Path Fits Your Vendors?

Engie's recent customer notification serves as a stress test for your risk management program. The company reported that its IT systems weren't compromised; instead, the breach occurred through a third-party marketing platform used by its partners for customer prospecting and energy offer marketing in France. The compromised data includes names, postal and email addresses, phone numbers, energy supply IDs, customer IDs, and contract numbers. No banking data was involved.

This situation highlights a Fourth and Nth Party Management issue within a customer data flow you might not have mapped.

The Decision You Are Facing

You need to decide how much control to exert over platforms that handle customer data but are outside your direct contracts. You have three options: bring the platform into your direct governance, hold your partners accountable, or restrict the data flowing to it.

Choosing the wrong path could mean either over-engineering oversight for a low-risk tool or leaving a prospecting platform with sensitive data outside your control.

Key Factors That Affect Your Choice

Consider these five questions before choosing a path:

1. What data does the platform hold or access? Contact details and account identifiers can enable impersonation. Engie's warning to customers highlighted this risk.
2. Who holds the contract? Is it direct, through a partner, or via a partner's partner?
3. Can you revoke access unilaterally? Engie disabled access after detecting unusual activity. This is only possible if you control the access.
4. Does the platform support a Critical or Important Function? Marketing tools may not, but the data they hold could have regulatory implications under data protection laws.
5. What visibility do you have into access activity? Detection is key to containing incidents quickly.

Path A: Bring the Platform into Direct Governance

Choose this if the platform holds identifiers linking a person to an account, and your partners can't demonstrate equivalent controls.

Steps to take:

• Conduct a Pre-Contractual Assessment and classify the platform based on data sensitivity.
• Use SIG Core as a baseline questionnaire, adding questions on access logging and anomaly detection.
• Negotiate a Right to Audit, a Notification Timeline in hours, and a Sub-Processor Disclosure obligation.
• Include the platform in Continuous Monitoring, using a Cyber Risk Rating as a prompt for questions.

Driving requirements: ISO 27036 for information security in supplier relationships; for financial entities, the EBA Outsourcing Guidelines and SR 23-4 set oversight expectations.

Trade-off: This is the most resource-intensive path, justified by high data sensitivity.

Path B: Hold Partners Accountable for the Platform

Choose this if your partners are the contracting party, the data exposure is moderate, and taking over the relationship isn't feasible.

Steps to take:

• Write flow-down obligations into partner agreements, including disclosure of platforms used and incident reporting timelines.
• Include a Sub-Outsourcing Clause requiring your approval for platforms touching your data.
• Strengthen Liability and Indemnification terms to protect against partner failures.
• Require evidence of compliance, such as assessment reports and access reviews.
• Test Vendor Breach Management jointly with partners.

Trade-off: You inherit the partner's weaknesses. This path works if your Incident Escalation chain is frictionless and you can demand Access Revocation.

Path C: Restrict the Data Flow

Choose this if the platform can't meet your requirements, or sharing full customer records isn't justified.

Steps to take:

• Apply data minimization to prospecting workflows. Consider pseudonymized references instead of full identifiers.
• Segment datasets to prevent a single breach from exposing complete profiles.
• Set retention limits and require scheduled data deletion.
• If controls remain inadequate, trigger your Wind-Down Plan and assess Substitutability before termination.

Trade-off: Marketing teams may resist. Frame it as reducing notification populations and fraud exposure.

Incident Response: A Universal Requirement

Regardless of the path chosen, rehearse the customer-data scenario. Engie's notification effectively informed customers about the data involved and potential fraud risks. Your plan should include:

• Quick identification of affected customers.
• Pre-approved customer notification language with phishing warnings.
• Regulator engagement under applicable data protection and sector rules.
• Enhanced monitoring after containment.

Consider threat history. The same group that listed Engie on a leak site after Salesforce compromises shows that extortion actors target large brands repeatedly. Your threat modeling should account for this.

Summary Matrix

Most programs will mix these approaches. Use Path A for platforms with linkable identifiers, Path B for lower-sensitivity partner tools, and Path C where data sharing can't be justified. Make the choice deliberately, before a partner's marketing tool forces it upon you.