Skip to content
Hacker Posts

CenterPoint Energy breach hits 1M+ Texans, utility confirms

CenterPoint Energy told the Texas AG that 1,062,060 residents had names, addresses, SSNs and driver's license numbers exposed; a forum hacker claims 7.49 million records in all.

Published 3 min read
breachcenterpoint-energyutilities

Houston utility CenterPoint Energy has confirmed a data breach affecting more than a million people, after a notice filed this week with the Texas Attorney General's data-breach portal put the Texas count at 1,062,060 residents. CenterPoint first disclosed the incident in a Form 8-K filed with the SEC on September 14, after a third party posted on a cybercrime forum claiming to hold its customer data. Electric and gas service were not affected.

What's confirmed

  • Who: CenterPoint Energy, which delivers electricity and natural gas in Texas and also serves Indiana, Minnesota and Ohio.
  • Scope reported to Texas: 1,062,060 Texas residents. The total across all states has not been stated.
  • Data exposed (per the Texas notice): names, addresses, Social Security numbers and driver's license numbers.
  • Discovery: CenterPoint said in its 8-K that it became aware of the breach in September through the threat actor's public forum post — not through its own detection.

The attacker's claim

A hacker posted on a cybercrime forum claiming roughly 7.49 million records, and made a 2.5 GB archive available for download around September 12. CenterPoint has not confirmed that figure; the archive reportedly also contained about 3 million phone numbers. No group or individual has been named, and no ransomware claim or known vulnerability (MOVEit/Cleo-style) has been tied to the incident in the company's filings or public reporting. Treat the 7.49 million number as an unverified attacker claim and the 1,062,060 Texas figure as the regulator-filed count.

Exploitation / fallout

Notification letters to affected individuals had apparently not gone out as of October 15, roughly a month after the SEC disclosure. CenterPoint says it does not currently believe the incident is reasonably likely to have a material financial impact. Several class-action lawsuits have already been filed across multiple states.

Action checklist

  1. If you're a CenterPoint customer, assume name, address, SSN and driver's license number may be in the dump. Freeze credit at all three bureaus and watch for utility-themed phishing and account-takeover attempts.
  2. IR and fraud teams at banks and identity providers: the 2.5 GB archive is circulating; treat the exposed PII as live for synthetic-identity and SIM-swap abuse.
  3. Watch for the notification letters — their arrival (and the enrollment code for any offered monitoring) is a common phishing lure after a breach of this size.

Context

This is a now-routine shape: external-facing system breached, scale surfaced not by the victim's telemetry but by a forum post, and the official count arriving through a state AG filing weeks later. The gap between the attacker's 7.49 million claim and the 1,062,060 reported to Texas is the detail to watch — it usually narrows as more states' notifications land.

Related stories