CenterPoint Energy confirms customer data stolen in cyberattack
- September 15, 2026
- 12:40 PM
- 0
CenterPoint Energy disclosed a breach compromising some customers’ personal information after an attacker leaked data allegedly stolen from the utility company.
An investigation started after the company discovered an online post from a threat actor claiming to have stolen 7.49 million records.
CenterPoint Energy is a Houston-based public utility company that provides electric and natural gas services and operates power generation facilities.
It serves approximately 7 million metered customers across Indiana, Minnesota, Ohio, and Texas, and employs roughly 8,300 people, generating over $9.3 billion in annual revenue.
Earlier this month, a threat actor using the alias “4d722e4d656f77” told BleepingComputer they stole from CenterPoint Energy 7.49 million customer records that include names, phone numbers, service and billing addresses, account numbers, billing amounts, and partial Social Security numbers (SSNs).
The threat actor leaked the data, claiming that the company ignored their messages and treated them as a joke.
According to the intruder, they exfiltrated the data by iterating through millions of IDs on CenterPoint’s public API, which lacked rate limiting, web application firewall (WAF) protection, and other security measures against automated access.
In a filing with the U.S. Securities and Exchange Commission (SEC), CenterPoint Energy confirms that data was stolen, but does not name the threat actor, the number of affected customers, or the types of compromised data.
“While the investigation remains ongoing, the Company has determined that an unauthorized third party obtained personal information relating to a portion of the Company’s customers through one of the Company’s external-facing systems,” reads the SEC filing.
“The Company is continuing to work with third-party experts to determine the scope of customers and personal information affected by the incident and intends to notify affected customers and regulatory authorities as required by applicable law.”
CenterPoint Energy said its electric and gas services were not impacted by the cyberattack, and does not believe the incident will materially affect its business or financial condition.
CenterPoint has activated its incident-response procedures, hired third-party cybersecurity experts, strengthened protections on its systems, and reported the incident to law enforcement and regulators.
Multiple lawsuits proposing class actions against the firm have already been filed in federal courts by law firms representing potentially impacted customers, alleging the data breach occurred between August 17 and September 1.
.article-callout { background-color: #f0f6ff; width: 95%; max-width: 800px; margin: 15px auto; border-radius: 8px; border: 1px solid #d6ddee; display: flex; align-items: stretch; overflow: hidden; } .article-media { flex: 1; max-width: 220px; display: flex; } .article-media a { display: flex; width: 100%; height: 100%; } .article-media img { width: 100%; height: 100%; border-radius: 8px 0 0 8px; display: block; } .article-callout .article-media img { margin-top: 0 !important; height: 100% !important; } .article-body { flex: 2; padding: 10px; display: flex; flex-direction: column; justify-content: center; } .article-body h2 { font-size: 17px !important; font-weight: 700; color: #333; line-height: 1.4; font-family: Georgia, "Times New Roman", Times, serif; margin: 0 0 14px 0; } .article-body p { font-weight: bold; font-size: 14px; margin: 0 0 clamp(6px, 2vw, 14px) 0; } .article-link { background-color: #fff; border: 1px solid #3b59aa; color: black; text-align: center; text-decoration: none; border-radius: 8px; display: inline-block; font-size: 16px; font-weight: bold; padding: 10px 20px; width: fit-content; } @media (max-width: 600px) { .article-callout { flex-direction: column; align-items: center; } .article-media { max-width: 100%; } .article-media img { border-radius: 8px 8px 0 0; } .article-body { padding: 15px; width: 100%; } .article-link { width: 100%; margin: 0 auto; box-sizing: border-box; } }
Build your security blueprint for AI-powered attacks
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
Save your seatRelated Articles:
ShinyHunters data leaks fuel $2,000 sextortion email scam
Australian energy provider Origin says data breach exposes client data
IDScan confirms breach tied to 153 million stolen driver’s licenses
220 million traveler records exposed in Vietnam-linked APIS leak
IDScan sued over alleged data breach affecting 153 million drivers
Was this article helpful?