CenterPoint Energy is a regulated utility company used to deliver natural gas and electricity infrastructure, maintain power grids and pipelines, and restore service across parts of Texas, Indiana, Ohio, and Minnesota.
The organization disclosed a data breach affecting more than 1 million people in Texas. This week, CenterPoint Energy told the Texas Attorney General’s Office that the breach affected 1,062,060 Texas residents. The company does not appear to have notified the affected individuals by letter.
“More than one million Texans were affected by a CenterPoint Energy data breach that compromised sensitive personal information, according to newly published information from the Texas Attorney General’s Office.” reported the broadcast Click2Huston. “The state’s data breach database lists 1,062,060 Texans as being affected. The information involved includes customers’ names, addresses, Social Security information and driver’s-license numbers.”
Days before the first disclosure, on September 12, a threat actor using the alias “4d722e4d656f77” claimed on a cybercrime forum to have extracted roughly 7.49 million customer records from CenterPoint Energy.
“In September 2026, CenterPoint Energy, Inc. (the “Company”) became aware of an online post by a third party claiming to have obtained a data set containing certain of the Company’s customer information.” reads the FORM 8-K report filed with SEC.”While the investigation remains ongoing, the Company has determined that an unauthorized third party obtained personal information relating to a portion of the Company’s customers through one of the Company’s external facing systems (the “Incident”).”
The hacker claimed the theft of names, phone numbers, service and billing addresses, account numbers, billing amounts, payment status, and partial Social Security numbers. He offered a 2.5 GB archive for download. The attacker warned that “next time we won’t simply pull data, we’ll start attacking the main infrastructure,” a line that reads well on a forum but should still be taken seriously by any critical infrastructure operator.
The attackers claimed they stole over the records through an API they say lacked proper WAF protection, rate limiting, and authentication. They also claimed the company tried to stop the data dump only after millions of records had been extracted.
“CenterPoint Energy continues to actively investigate the cybersecurity incident disclosed last month. Upon learning of the issue, CenterPoint activated our incident response procedures and engaged external cybersecurity, forensic, and legal advisors to assist with the investigation.” a spokesperson for CenterPoint said on Wednesday. “We continue to work with third-party experts to assess the scope of affected customer data to identify which customers will be provided notifications in accordance with applicable legal requirements.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, data breach)
CenterPoint Energy admitted on Monday that an intruder stole personal information belonging to some of its customers. The Houston-based utility, which supplies electricity and gas to about 7 million accounts across Texas, Indiana, Minnesota and Ohio, disclosed the breach in an SEC filing after a hacker started advertising the data online.
“In September 2026, CenterPoint Energy, Inc. (the “Company”) became aware of an online post by a third party claiming to have obtained a data set containing certain of the Company’s customer information.” reads the FORM 8-K report filed with SEC.”While the investigation remains ongoing, the Company has determined that an unauthorized third party obtained personal information relating to a portion of the Company’s customers through one of the Company’s external facing systems (the “Incident”).”
CenterPoint said its energy services were not affected. The company is investigating the breach, assessing exposed data, and will notify affected customers, regulators and law enforcement as required.
The company locked down its systems after seeing a post on a dark web forum where a hacker leaked data allegedly stolen from its systems.
On September 12, a threat actor using the alias “4d722e4d656f77” claimed on a cybercrime forum to have extracted roughly 7.49 million customer records from CenterPoint Energy.
“We’ve obtained well over 7.49 Million, each single one line which converts to 7 files in total of (.jsonl) format, which upholds per line 1 user, and we’ve obtained well over 7.49 million lines. As for the (CSV), we’ve filtered long text from (Jsonl), so the CSV will uphold the full PII (personal identity information).” the hacker claimed in the post. “It’s quite funny to think a $26.2 billion company has WEAK protection. We obtained said data from an API they managed and controlled, which lacked proper WAF protection, rate limiting, certification protection, and no JWT/Auth token to pull said data. Mid the 7.49 million mark, they did an attempt to stop us dumping data, which, with a simple CAPTCHA key, in terms, we would have pulled 17.44 million data from said company.”
The hacker claimed the theft of names, phone numbers, service and billing addresses, account numbers, billing amounts, payment status and partial Social Security numbers. He offered a 2.5 GB archive for download. The attacker warned that “next time we won’t simply pull data, we’ll start attacking the main infrastructure,” a line that reads well on a forum but should still be taken seriously by any critical infrastructure operator.
The attackers claim they stole over 7.49 million records through an API they say lacked proper WAF protection, rate limiting and authentication. They also claim the company tried to stop the data dump only after millions of records had been extracted.
CenterPoint’s SEC filing does not name the threat actor, confirm the 7.49 million figure or detail exactly which fields were exposed. It only states that an unauthorized third party obtained personal information “relating to a portion of the Company’s customers through one of the Company’s external-facing systems.” Independent outlets have not been able to fully validate the leaked dataset, and attackers often inflate numbers or repackage old data, so the final scope may differ from the claims.
For now, the takeaway is simple. If you are a CenterPoint customer, assume that your name, address, account details and at least part of your Social Security number may have been exposed. Be careful with targeted phishing, credential-stuffing attacks and fake billing messages that use this information to look legitimate.
The same risk applies across the sector. Internet-facing systems, weak API security and misconfigured services can give attackers an easy way in, while companies may struggle to detect and stop the attack before data is stolen.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, newsletter)
Hackers access Australian customers’ names, addresses, dates of birth, phone numbers and some bank account details, company says
Get our breaking news email, free app or daily news podcast
Origin Energy customers’ addresses, phone numbers and partial bank account data have been accessed in a hack, the company has confirmed.
The firm has 4.8m customer accounts in Australia, providing electricity, fossil gas, LPG and internet services to homes and businesses.
Continue reading...
© Photograph: Jason Reed/Reuters
© Photograph: Jason Reed/Reuters
© Photograph: Jason Reed/Reuters
Entrar