CenterPoint Energy says attacker accessed customer data via online system
Utility reports a data breach affecting some customer records but says energy services remain unaffected.
CenterPoint Energy reported in an SEC Form 8-K that an attacker accessed one of its internet-facing systems and stole personal data for some of its customers. The Houston-based utility, which serves about 7 million electricity and gas customers, says service operations were not disrupted and it does not expect a material financial impact. A threat actor claims to have pulled 7.49 million files via a poorly secured API, allegedly including names, contact information, billing records, move‑in dates, driver’s license details, and partial Social Security numbers. CenterPoint is working with external experts to determine which customers and data fields were affected and plans to notify impacted individuals and regulators as required. The company has also informed law enforcement and some regulatory bodies about the breach.
Why it matters
The breach puts some CenterPoint customers at risk of sensitive personal data exposure, even though their power and gas service continues as normal. Personal details, billing information, and partial Social Security numbers may now be in an attacker’s hands, raising the likelihood of targeted fraud or identity misuse. CenterPoint is still working to identify exactly who is affected and plans to notify those customers and regulators while law enforcement investigates.