How Did CenterPoint Energy Lose Over 1 Million Customer Records?

CenterPoint Energy, a public utility serving multiple states, reported a significant data breach affecting customer records. The incident involves the theft of personally identifiable information from the company's systems. This event impacts organizations that rely on secure handling of sensitive consumer data and highlights the risks of delayed detection in utility infrastructure.

Root cause

The utility company learned of the unauthorized access only after a threat actor publicly boasted about the theft. According to SecurityWeek, the hacker claimed to have obtained nearly 7.5 million user records on a known cybercrime forum. CenterPoint Energy confirmed in its Securities and Exchange Commission filing that the public post triggered their awareness of the breach, rather than internal monitoring systems.

Attack path

The threat actor exfiltrated data and made it available for download online. On September 12, a 2.5-gigabyte archive was released, allegedly containing the stolen information. This file reportedly included approximately 3 million phone numbers alongside other personal details. The company stated that the incident did not impact its operational systems, suggesting the attack focused on data extraction rather than service disruption.

Affected versions

• Over 1,062,060 Texas residents are confirmed to have had their data compromised.
• The initial hacker claim suggested nearly 7.5 million records were obtained.
• Residents in Indiana, Minnesota, and Ohio may also be affected, though totals are unclear.

Mitigation

• CenterPoint Energy has notified the Texas Attorney General’s Office.
• The company has not yet sent notification letters to impacted individuals.
• No specific software patch or technical fix for the underlying vulnerability has been confirmed by the vendor.

What it means for organisations

Operations teams must verify if their detection mechanisms rely solely on external alerts. Security leaders should assess how quickly they can confirm data loss after public claims. Legal and compliance departments need to prepare for regulatory notifications across multiple jurisdictions. Communication teams should draft customer advisories before official confirmations arrive. Supply chain managers must review third-party access logs. This event underscores the need for proactive monitoring rather than reactive discovery.

Background: Personally identifiable information

Personally identifiable information matters because it is the primary currency of identity theft and fraud. Without strict controls, attackers use this data to bypass security checks and impersonate victims. Protecting it reduces your liability and prevents the cascading damage that follows a single data leak.

Read the full guide: Why Is Personally Identifiable Information Important to Security

What to do and how to stay safe: CenterPoint Energy

• Monitor credit reports and financial statements for unauthorized activity.
• Enable multi-factor authentication on all personal accounts linked to the affected utility.
• Consider placing a fraud alert or credit freeze with major credit bureaus.
• Watch for phishing emails that may use the stolen personal information to appear legitimate.

Step-by-step guide: Data Breaches Explained: How to Spot the Leak Before It Hurts

General security guidance from the CloudSec Press newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What specific data was stolen from CenterPoint Energy?

The compromised information includes names, addresses, Social Security numbers, and driver’s license numbers.

Which states are affected by this breach?

Texas residents are confirmed affected, but customers in Indiana, Minnesota, and Ohio may also be impacted.

Has CenterPoint Energy notified the affected customers directly?

The company has not yet sent notification letters to the impacted individuals.