CenterPoint Energy

Summary

CenterPoint Energy, a Houston-based public utility providing electric and natural gas services to about seven million customers across several states, disclosed that an unauthorized third party accessed personal information through one of its external-facing systems. The breach involved the exfiltration of millions of customer records via a public API lacking rate limiting and web application firewall protections, with leaked data including names, phone numbers, service and billing addresses, account numbers, billing amounts, and partial Social Security numbers. Although the company confirmed the incident in an SEC filing, it did not disclose the threat actor’s identity, the exact number of affected customers, or the full scope of compromised data, and stated that its utility services remained uninterrupted. The company has engaged third‑party cybersecurity experts, strengthened system protections, reported the incident to law enforcement and regulators, and faces multiple class‑action lawsuits alleging the breach occurred over a recent period.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On September 1, 2026, a threat actor using the alias “4d722e4d656f77” posted a claim online that they had leaked CenterPoint Energy data. The actor stated that they had obtained 7.49 million customer records. According to the claim, the data was taken by iterating through millions of identifiers on CenterPoint’s public-facing API. The actor said the API lacked rate limiting, web application firewall protection, and other security controls against automated access. The exposed information included names, phone numbers, service and billing addresses, account numbers, billing amounts, and partial Social Security numbers. The leak was reported in JSON and CSV formats. The actor said they had contacted the company beforehand but felt ignored and treated as a joke. Subsequent class action filings allege that the unauthorized access occurred between August 17 and September 1, 2026. CenterPoint Energy serves roughly seven million metered customers across Indiana, Minnesota, Ohio, and Texas. The company employs about 8,300 people and reports over $9.3 billion in annual revenue.

CenterPoint Energy filed a notice with the U.S. Securities and Exchange Commission confirming that an unauthorized third party obtained personal information relating to a portion of its customers. The SEC filing stated that the breach occurred through one of the company’s external‑facing systems. The company said its investigation was ongoing and that it was working with third‑party cybersecurity experts. CenterPoint Energy reported that it had strengthened protections on its systems and had notified law enforcement and regulators. The utility emphasized that its electric and natural gas services were not disrupted by the cyberattack. It also stated that it did not believe the incident would materially affect its business or financial condition. Multiple law firms have already filed proposed class actions in federal court on behalf of potentially affected customers. The lawsuits allege violations of data privacy laws and seek remedies for the alleged exposure of personal information.

The law firm’s press release listed additional data elements that may have been compromised, including premise IDs, payment status, service details, and autopay or paperless billing enrollment status. The release noted that individuals who received a breach notification from CenterPoint Energy could face an increased risk of identity theft and fraud. The press release also stated that the firm is investigating potential class action claims arising from the breach.

Sources

Sources available to members: 2 sources.