CenterPoint Energy, the Houston-based utility that delivers electricity and natural gas to roughly 7 million customers across Texas, Indiana, Minnesota, and Ohio, has confirmed a data breach affecting a portion of its customer base, with a Texas filing dated October 14, 2026 identifying 1,062,060 affected Texas residents. The company disclosed the incident in a Form 8-K filed with the Securities and Exchange Commission on September 14, 2026, after a threat actor posted claims online that a dataset containing millions of CenterPoint customer records had been stolen and put up for sale.
The disclosure has been picked up by outlets including ABC13 Houston, Click2Houston, and FOX 26 Houston, alongside national cybersecurity press such as BleepingComputer and SecurityWeek. The story has quickly become one of the most-searched cybersecurity headlines of the week, and for good reason: a breach at a regulated utility touches customers who have no choice but to hand over their personal and billing information just to keep the lights on.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Happened: CenterPoint Energy Confirms a Data Breach
CenterPoint’s SEC Filing, in Its Own Words
According to the company’s SEC filing, first reported by Reuters on September 14, 2026, CenterPoint became aware in September 2026 of an online post from a third party claiming to have obtained a dataset containing customer information. An investigation determined that an unauthorized party had accessed personal information belonging to a portion of CenterPoint’s customers through one of the company’s external-facing systems. CenterPoint has stressed that the intrusion did not touch the systems that control electricity or natural gas delivery, and that service to customers has not been disrupted.
What the Company Still Isn’t Confirming
The company has not confirmed the full scope of the breach, saying instead that it is still working with outside cybersecurity specialists to determine exactly which customers and which categories of data were involved. That distinction matters: CenterPoint is confirming that a breach occurred and that customer data was accessed, while explicitly declining to confirm the specific record count that a hacker has publicized. This is a common pattern in 2026 breach disclosures, where companies acknowledge unauthorized access quickly to satisfy SEC materiality rules, then spend weeks or months on forensic work before issuing a final tally. That careful phrasing is now close to a template for SEC-regulated breach disclosures: confirm that unauthorized access happened, describe the affected system category in broad terms, and hold back specifics like an exact record count until the forensic review is further along.
Timeline: From a Dark Web Post to an SEC Filing
The Initial Forum Post
Reporting from The Record, the news arm of Recorded Future, and The Register lays out a timeline in which a threat actor using the online handle 4d722e4d656f77 posted on a cybercrime forum on September 12, 2026, claiming to have obtained a database tied to CenterPoint customers. Information reported to Texas authorities places the unauthorized access earlier, between August 19 and 22, 2026, so the access came before the first public post. The actor’s description of how the data was pulled has not been verified.
September 14: CenterPoint Files Its 8-K
CenterPoint’s SEC filing followed on September 14, just after the forum claim of September 12, and said an unauthorized third party had obtained some customer personal information through an externally exposed company system. The short gap between the forum post and the formal filing gave researchers and journalists little time to examine the leaked samples before CenterPoint’s own statement caught up with the story circulating in security circles. A quick turnaround between an attacker’s public claim and a company’s formal SEC disclosure typically reflects the time needed to confirm that unauthorized access actually occurred, bring in outside forensic firms, and draft language that satisfies securities counsel without overstating what has actually been verified.
How Many Customers Are Affected? The 7.49 Million Question
7.49 Million vs. 6.73 Million: Two Competing Numbers
The number driving most of the coverage is 7.49 million, a figure Security Affairs reported on September 16, 2026 after reviewing a threat actor’s claim. A day earlier, on September 15, 2026, TechNadu reported a separate post from a threat actor claiming a more precise 6,734,894 customer records had been stolen, described as a filtered or deduplicated subset. CenterPoint has not confirmed either number, and the company has explicitly said it cannot yet verify the authenticity of the published dataset. The only figure that has surfaced in a regulatory record is the 1,062,060 affected Texas residents in a Texas filing dated October 14, 2026, which is not necessarily the companywide total. Given that CenterPoint serves close to 7 million customer accounts in total, a claim of 7.49 million raw records would imply the leak, if fully authentic, could touch a large share of the utility’s entire customer base, though duplicate entries, historical accounts, and formatting artifacts commonly inflate raw record counts well above the number of actual individuals affected.
Why Raw Record Counts Rarely Match the Final Tally
The two figures the threat actor has publicized sit roughly 755,000 records apart, 7.49 million versus TechNadu’s reported 6,734,894, a gap consistent with what typically happens when a raw database export gets filtered for duplicates, test entries, and incomplete rows. It is also worth noting that the claimed 7.49 million already exceeds CenterPoint’s approximate 7 million total customer accounts across all four states, which on its own suggests the raw figure counts individual billing records, service-address changes, or historical accounts rather than 7.49 million distinct people. Breach investigations that start with an inflated attacker-supplied number and end with a smaller, company-confirmed count of unique individuals have become the norm rather than the exception in 2026, and CenterPoint’s forensic review will need to resolve that gap before any customer receives a notification letter tied to a specific, confirmed record count.
This is the same pattern security reporters flagged with the IDScan.net breach earlier this year, where an initial hacker claim of 150 million identity records took weeks of company forensic review before a narrower, confirmed figure emerged. CenterPoint appears to be following the same cautious playbook: acknowledge the intrusion, decline to validate the attacker’s number, and promise formal notifications once the internal review concludes.
What Customer Data Was Exposed
The Data Fields Named in the Leaked Sample
Based on the sample the threat actor posted and reviewed by multiple outlets, the alleged dataset includes customer names, phone numbers, email addresses, service and billing addresses, account and premise identifiers, billing amounts, move-in dates, payment status, autopay and paperless billing enrollment, driver’s license information, and the last four digits of Social Security numbers. That is not a password dump or a credential leak in the traditional sense. It is the kind of account, billing, and identity-document metadata that utilities accumulate simply by serving customers for years, which makes it valuable for identity-theft and social-engineering schemes rather than for direct account takeover. Public reporting on the disclosure to Texas authorities separately lists names, addresses, Social Security information, and driver’s-license numbers as the data categories tied to the affected Texas residents.
Why This Specific Combination Enables Fraud
Partial Social Security numbers, on their own, are not enough to open new lines of credit. Combined with a full name, billing address, phone number, and account number, though, they give scammers exactly what they need to run convincing utility-impersonation phishing calls, a scam type that spikes every time a major utility discloses a breach. Add a driver’s license number and a move-in date into that mix, and the exposure starts to look less like routine billing metadata and more like a starter kit for full identity theft, since a driver’s license number is frequently accepted as a secondary identity document when opening new accounts or verifying identity with banks, other utilities, and government agencies. Individually, most of these data points already circulate across old breaches, data broker sites, or public records. What makes this particular combination more dangerous is that it pairs the financial identifiers a scammer needs to sound credible on a call, such as an account number and last billing amount, with the identity-verification documents a scammer needs to pass as the actual customer, such as a driver’s license number and move-in date. That pairing is what separates a nuisance breach from one that meaningfully raises a customer’s identity-theft exposure for years rather than weeks. Customers should expect a wave of calls and texts claiming to be from CenterPoint over the coming weeks, and the company’s own billing data makes those calls easier to fake convincingly.
How the Breach Reportedly Happened: An Exposed API
The Attacker’s Technical Account
The attacker’s own account of the incident, as relayed by The Register, points to an internet-facing API that allegedly lacked sufficient authentication and rate-limiting controls, allowing bulk extraction of customer records rather than a single stolen credential or a targeted phishing compromise. CenterPoint’s own filing is less specific, describing only that an unauthorized third party obtained information “through one of the Company’s external-facing systems,” without naming the API or confirming the attacker’s technical narrative.
CenterPoint’s More Guarded Version
If the attacker’s version holds up under CenterPoint’s own investigation, this breach fits a pattern that has become depressingly familiar in 2026: not a sophisticated zero-day, but a public-facing endpoint that was reachable without the rate limits, authentication checks, or anomaly detection that would normally catch someone scraping millions of records in a short window. Exposed and under-protected APIs have become one of the most common root causes behind large-scale consumer data breaches this year, precisely because they sit at the intersection of convenience (self-service customer portals, mobile apps, partner integrations) and exposure (public internet reachability). Neither account has been independently verified by a third-party security researcher, and CenterPoint has not confirmed the attacker’s specific claim about missing authentication or rate limits. What both versions agree on is the general shape of the incident: data pulled from a single external-facing system rather than a phishing campaign, a ransomware deployment, or a compromised employee credential, which narrows the likely root cause even before CenterPoint’s investigation formally concludes.
CenterPoint’s Official Response So Far
CenterPoint says it activated its cybersecurity incident response protocols as soon as it became aware of the forum post, brought in outside cybersecurity specialists to assist with the investigation, and has taken additional steps to protect its systems. The company has also notified law enforcement and certain regulators, and says it intends to notify affected customers and any additional required authorities once it has determined the full scope of the incident. Help Net Security reported on September 16, 2026 that CenterPoint reaffirmed this commitment, stating it would notify affected customers and regulators as legally required once its review concludes, consistent with state breach-notification laws that generally require covered entities to alert impacted residents within a defined window after confirming a breach.
Crucially, CenterPoint has repeated across every version of its statement that electric and natural gas delivery has not been affected and remains fully operational, and no service interruption has been reported. That separation between “customer data was accessed” and “the grid is fine” is deliberate messaging, aimed at reassuring the roughly 7 million households and businesses who rely on CenterPoint for power and heat that this is a data-privacy incident, not an operational-technology or grid-safety one.
Market and Financial Impact for CenterPoint (NYSE: CNP)
CenterPoint’s Own Materiality Language
In its 8-K, CenterPoint stated that, as of the filing date, it does not believe it is reasonably likely that the incident will have a material impact on the company’s financial condition or results of operations. That is standard boilerplate language for breach disclosures and should not be read as a guarantee; it is a snapshot judgment made before litigation costs, regulatory penalties, or expanded notification obligations are known. SEC materiality determinations are inherently forward-looking and get revisited as new information arrives, which is why CenterPoint frames its no-material-impact conclusion as being true “as of the filing date” rather than as a permanent judgment. If the confirmed record count, litigation costs, or regulatory findings change materially in the coming months, an amended filing updating that assessment would not be unusual. Regulated utilities like CenterPoint also carry an added layer of exposure that purely commercial companies don’t: state utility commissions can weigh cybersecurity practices into rate-case reviews, meaning a breach can resurface months later in a completely different regulatory proceeding tied to what customers pay on their bills.
What the AT&T Settlement Suggests About Cost
Investors have seen this movie before. When AT&T disclosed its 2024 breaches affecting 73 million and later close to 109 million customers, the company ultimately agreed to a $177 million settlement in 2025 to resolve the resulting lawsuits. CenterPoint’s claimed exposure is smaller in scale, but the legal and reputational playbook that follows a confirmed utility or telecom breach tends to look similar regardless of company size: class actions filed within days, a multi-year settlement process, and years of credit-monitoring offers bundled into the eventual resolution.
Legal Fallout: Class Actions and Law Firm Investigations
Edelson Lechtzin’s Investigation
Plaintiffs’ law firms moved almost immediately. Edelson Lechtzin LLP announced an investigation into the breach and the exposure of CenterPoint customer personal information, according to a PRNewswire release, and multiple proposed class-action complaints have already been filed against the company over the alleged breach. This is now a near-automatic response to any breach disclosure involving Social Security number fragments, driver’s license numbers, and utility billing data: plaintiffs’ firms compete to be named lead counsel, complaints get consolidated, and the case typically proceeds toward a negotiated settlement rather than trial, following the same trajectory seen in the AT&T, Change Healthcare, and National Public Data litigation of the past two years.
How These Cases Typically Resolve
Proposed class actions filed in the days after a breach disclosure are rarely the final word. Multiple overlapping suits typically get consolidated before a single judge, a lead counsel gets appointed, and the case proceeds toward a negotiated settlement that can take one to three years to finalize. The AT&T settlement referenced above followed exactly that path, moving from initial filings to a $177 million resolution roughly a year after the breaches were disclosed. For affected customers, the practical value of these lawsuits is usually a future claims process offering free credit monitoring or a modest cash payment years down the line, not immediate compensation. The more urgent protective step is monitoring accounts and credit reports directly, rather than waiting on litigation to resolve.
CenterPoint Energy Data Breach: Key Facts at a Glance
| Detail | What’s Known |
|---|---|
| Company | CenterPoint Energy Inc. (NYSE: CNP), Houston, Texas |
| Customers served | Approximately 7 million electric and natural gas customers across Texas, Indiana, Minnesota, and Ohio |
| SEC disclosure date | September 14, 2026 (Form 8-K) |
| Threat actor’s claim | 7.49 million raw records / 6.73 million filtered records, posted September 12, 2026 |
| Confirmed by CenterPoint? | No: company has not verified the attacker’s figure or dataset authenticity |
| Alleged data types | Names, phone numbers, emails, service/billing addresses, account and premise IDs, billing amounts, move-in dates, payment status, autopay status, driver’s license information, partial Social Security numbers |
| Alleged entry point | An external-facing company system / API, per the attacker’s own claims |
| Service impact | None reported: electric and gas delivery remain operational |
| Law enforcement notified | Yes, along with certain regulators |
| Legal action | Multiple proposed class actions filed; Edelson Lechtzin LLP investigation announced |
How This Compares to Other Major 2026 Data Breaches
CenterPoint’s breach is significant, but it is far from the largest data-exposure event of the past two years, and comparing it against other recent incidents helps put the 7.49 million figure into perspective. The IDScan.net breach disclosed earlier in 2026 involved an initial hacker claim in the range of 150 million identity records tied to enterprise clients, while the 2024 National Public Data breach saw hackers claim 2.9 billion raw records, later narrowed to roughly 272 million actual individuals affected once the company confirmed the incident. AT&T’s 2024 breaches, by contrast, involved confirmed figures of 73 million and close to 109 million customers respectively, both fully acknowledged by the company rather than left as an unverified attacker claim.
What sets CenterPoint apart so far is the gap between the attacker’s number and the company’s own silence on scope. Other breaches this year involving personal data, including the Florida DMV login breach and the Trezor breach linked to a Brevo phishing compromise, followed a similar pattern of an early unverified claim followed by a narrower company-confirmed count weeks later. CenterPoint customers should expect the same delay before an authoritative number arrives.
| Breach | Year Disclosed | Records Claimed / Confirmed | Status |
|---|---|---|---|
| CenterPoint Energy | 2026 | 7.49M raw claimed (unconfirmed) | Under investigation |
| IDScan.net | 2026 | ~150M claimed initially | Confirmed, narrower scope later |
| National Public Data | 2024 | 2.9B raw claimed / ~272M individuals | Confirmed |
| AT&T (dark web leak) | 2024 | 73M customers | Confirmed, $177M settlement in 2025 |
| AT&T (Snowflake-linked) | 2024 | ~109M customers | Confirmed, part of same settlement |
Why Utilities Have Become a Prime Target
Data Customers Can’t Opt Out Of
Utility companies occupy an unusual position in the breach landscape. Customers cannot opt out of sharing personal and billing data with their power or gas provider the way they might avoid a retailer or a social network, which means utility databases accumulate years of stable, high-confidence personal information: names tied to real addresses, real phone numbers, real payment histories. That makes utility data especially useful for identity theft and for crafting convincing phishing and vishing campaigns, since a scammer who already knows a target’s account number and last bill amount sounds far more credible impersonating “CenterPoint billing” than a random caller claiming to be from a bank. Unlike a retailer breach, where an unhappy customer can simply shop somewhere else, most CenterPoint customers have no alternative electric or gas provider to switch to, since the company operates as a regulated monopoly within each of its service territories. That removes the usual market pressure of customers taking their business elsewhere, leaving regulatory oversight and litigation as the primary forces pushing utilities to invest in protecting customer data.
Legacy IT Sprawl Across Four States
Utilities also tend to run large portfolios of legacy billing systems alongside newer customer-facing apps and APIs, often the product of mergers, regional subsidiaries, and decades of incremental IT investment. Utilities also typically collect a driver’s license number and record a move-in date when a customer first opens service, since both are used to verify identity and establish exactly when billing responsibility begins, which is exactly why identity-document fields like these turn up in a utility breach even though a typical online retailer would never store them. CenterPoint itself operates across four states with different regulatory regimes, which historically has meant integrating multiple back-end systems rather than a single unified platform. Texas, Indiana, Minnesota, and Ohio each maintain their own breach-notification statute, meaning CenterPoint’s legal and compliance teams are managing several separate regulatory timelines at once rather than a single national standard. That kind of sprawl is exactly the environment where an under-protected external API can go unnoticed until a hacker finds it first.
What CenterPoint Customers Should Do Right Now
- Treat any unexpected call, text, or email claiming to be from CenterPoint Energy with suspicion, especially ones asking to “verify” an account number, billing amount, or Social Security number.
- Never click payment links sent by text message. CenterPoint’s official channels do not need customers to confirm account details that a scammer using leaked billing data might already appear to know.
- Watch bank and credit card statements for small unauthorized test charges, which are frequently used to validate stolen payment details before larger fraud attempts.
- Consider placing a fraud alert or credit freeze with the major credit bureaus if CenterPoint confirms Social Security number or driver’s license exposure in your specific case once formal notifications go out.
- If your driver’s license number was part of the exposure, watch for signs of its use in unrelated fraud, such as accounts opened with other companies, since a name, address, and driver’s license number together are often enough to pass basic identity checks.
- Save any breach notification letter or email from CenterPoint, since it may be required to participate in future class-action settlement claims.
Historical Context: A Pattern Regulators Are Watching Closely
The SEC’s Four-Day Disclosure Clock
The SEC’s 2023 cybersecurity disclosure rules, which require public companies to report material breaches within four business days of determining materiality, have fundamentally changed how incidents like CenterPoint’s reach the public. Before those rules took effect, a company could sit on a breach for weeks or months before any formal disclosure. Now, an 8-K filing arrives while the company is still mid-investigation, which is exactly why CenterPoint’s filing reads as cautious and incomplete rather than final. That four-business-day clock starts ticking once a company determines a breach is material, not when the intrusion was first discovered, which is why a filing can appear quickly even when the underlying incident began weeks earlier. Expect an amended 8-K or a follow-up statement once the forensic review concludes, a pattern that played out with both AT&T’s 2024 disclosures and the IDScan.net breach earlier this year.
Utilities Under a New Kind of Scrutiny
This is also not the first time a major U.S. utility or energy company has faced scrutiny over customer or systems security. Utility-sector cybersecurity has drawn sustained attention from the Department of Energy and CISA over the past several years, largely focused on protecting operational technology and grid control systems from nation-state actors. CenterPoint’s breach is different in nature, a customer-data exposure through a business-side system rather than an attack on grid operations, but it will still add to the broader argument that critical infrastructure operators need to treat customer-facing IT with the same rigor as their operational networks.
Predictions: What Happens Next
- CenterPoint will likely issue a follow-up disclosure or amended 8-K within four to eight weeks narrowing the confirmed record count, probably below the attacker’s claimed 7.49 million figure, consistent with how similar 2026 breach investigations have concluded.
- Expect the number of proposed class-action lawsuits to climb into the double digits within a month, following the same consolidation pattern seen with the IDScan.net and AT&T litigation.
- State regulators in at least one of CenterPoint’s four service territories will likely open a formal inquiry into the utility’s cybersecurity practices, given the heightened scrutiny utilities face post-breach.
- CenterPoint will almost certainly offer free credit monitoring to affected customers once formal notifications go out, mirroring the standard remediation package used across 2024 to 2026 breach disclosures.
- Other regional utilities are likely to face increased phishing and social-engineering attempts in the coming months, as CenterPoint’s exposed billing-data format gives scammers a proven template to adapt against other providers’ customers.
The Bigger Picture for Critical Infrastructure Cybersecurity
CenterPoint’s breach adds to a growing list of 2026 data breaches hitting sectors that customers cannot easily avoid, from DMVs to identity-verification vendors to now a regional utility. Each of these incidents reinforces the same lesson: the weakest link is rarely the flashiest system. It’s the quieter, external-facing API or portal that handles routine customer requests, exactly the kind of system that gets less security budget than headline-grabbing operational technology, yet holds just as much sensitive personal data. Expect this breach to be cited in coming months alongside cases like the Dropbox-Lenovo SSO breach and the Revolut fake-government-email breach as examples pushing companies toward stricter API authentication and rate-limiting standards.
For now, the most important number in this story remains unverified. CenterPoint says a breach happened; Texas reporting identifies 1,062,060 affected residents; the hacker says 7.49 million records were taken, a claim that remains an unverified allegation rather than a confirmed total; and the companywide figure, as usual with breach disclosures under the SEC’s four-day rule, will only be known once the forensic dust settles.
Frequently Asked Questions
Did CenterPoint Energy confirm a data breach?
Yes. CenterPoint Energy confirmed in a September 14, 2026 SEC filing that an unauthorized third party obtained personal information belonging to a portion of its customers through one of the company’s external-facing systems.
How many CenterPoint Energy customers were affected?
A threat actor claimed to have stolen 7.49 million raw customer records, per a Security Affairs report dated September 16, 2026, alongside a separate claim of 6,734,894 filtered records reported by TechNadu on September 15, 2026. CenterPoint has not confirmed either figure or verified the authenticity of the leaked dataset. Texas regulatory reporting from October 2026 identified 1,062,060 affected Texas residents, a count that is not necessarily the companywide total.
What information was exposed in the CenterPoint Energy breach?
The alleged dataset reportedly includes customer names, phone numbers, email addresses, service and billing addresses, account and premise identifiers, billing amounts, move-in dates, payment status, autopay enrollment, driver’s license information, and the last four digits of Social Security numbers.
Is CenterPoint Energy’s electric and gas service affected?
No. CenterPoint has stated repeatedly that the breach involved customer data systems only, and that electricity and natural gas delivery remain operational and undisrupted.
How did hackers reportedly access CenterPoint’s data?
The threat actor claimed the data came from an external-facing API that allegedly lacked adequate authentication and rate limiting. CenterPoint’s own filing confirms an external-facing system was involved but has not named the specific point of entry.
Has CenterPoint Energy been sued over the data breach?
Yes. Multiple proposed class-action lawsuits have been filed against CenterPoint, and law firm Edelson Lechtzin LLP has announced an investigation into the breach.
What should CenterPoint Energy customers do to protect themselves?
Customers should be wary of unsolicited calls, texts, or emails claiming to be from CenterPoint, avoid clicking payment links sent via text, monitor bank and credit statements for unauthorized charges, watch for signs of driver’s license misuse, and watch for an official breach notification letter confirming whether their specific data was affected.
When will CenterPoint confirm the final number of affected customers?
CenterPoint has not given a timeline, saying only that it is continuing to investigate the scope of the incident with outside cybersecurity experts and will notify affected customers and regulators once that work is complete.
