French civil engineering powerhouse Eiffage S.A., a leading construction and concessions company in Europe, has allegedly suffered a significant data breach. In May 2025, threat actors reportedly exploited the company’s File Transfer Service, leading to the exposure of a substantial amount of data. With revenues exceeding €23 billion and over 72,000 employees, Eiffage is a key player in major infrastructure projects across the continent, making this incident a notable security concern for the industry.
The company, which was instrumental in projects like the Channel Tunnel and the Millau Viaduct, along with its subsidiaries, is now at the center of a data security incident. The breach allegedly affects not only the parent company but also its major branches, including Eiffage Énergie Systèmes, Clemessy, and the Goyer Group, with a wide-reaching impact on its operations across France, Germany, Spain, and other European nations. The origin of the attack is attributed to malicious actors who claim to have exfiltrated the data.
The compromised information allegedly contains over 40,000 records. The exposed data is said to include sensitive personal and corporate information. The following data types were allegedly compromised in the leak:
- Employee and corporate partner full names
- Corporate email addresses
Eiffage has yet to release an official statement regarding the alleged breach. The incident highlights the persistent threat of cyberattacks against critical infrastructure and major corporate entities.