CenterPoint Energy Breach Impacts Over 1 Million Texans with SSNs

CenterPoint Energy notified the Texas Attorney General’s Office that the personal information of 1,062,060 state residents was compromised in a data breach, according to a report by SecurityWeek. The Houston-based utility made this disclosure one month after initially informing the Securities and Exchange Commission that customer information had been stolen from its systems.

The company confirmed in its SEC filing that it became aware of the incident only after a threat actor publicly boasted about obtaining nearly 7.5 million user records from CenterPoint Energy on a known cybercrime forum. The utility stated that only a portion of its customers were affected by the theft and that the incident did not disrupt its operational capabilities.

Context and Background

SecurityWeek reported that the hacker made a 2.5-gigabyte archive available for download on September 12, allegedly containing data exfiltrated from the utility. This file seemingly contains approximately 3 million phone numbers along with additional personal information. CenterPoint Energy noted in its regulatory filing that the compromised information includes names, addresses, Social Security numbers, and driver’s license numbers.

It appears that the utility has not yet sent notification letters to the impacted individuals directly. SecurityWeek has emailed CenterPoint Energy for clarification on the total number of individuals impacted and stated it will update its article if the company responds. The initial disclosure to the SEC came just days after the hacker’s public post regarding the stolen records.

Who Is Affected

While the recent notification specifically identified over one million Texas residents, CenterPoint Energy also delivers electricity and natural gas to customers in Indiana, Minnesota, and Ohio. Residents of those states might have been affected as well, though the total impact from the incident remains unclear. The company has not provided a breakdown of affected customers by state in its public filings.

The breach involves individuals whose personal data was accessed by the threat actor. The inclusion of Social Security numbers and driver’s license numbers in the compromised dataset was confirmed by the company's filing. The exact number of affected residents in Indiana, Minnesota, and Ohio has not been publicly disclosed by the company or authorities.

What should you do?

Readers should monitor their credit reports and financial statements for unauthorized activity, as sensitive identity documents were exposed. Checking for new accounts or loans opened in one's name is advisable given the theft of Social Security numbers. Individuals may consider placing fraud alerts or credit freezes to prevent new credit from being issued.

What to do and how to stay safe: CenterPoint Energy

• Review credit reports from all three major bureaus for unfamiliar accounts or inquiries.
• Place a fraud alert or credit freeze on your credit file to block new account openings.
• Monitor bank and utility statements for unauthorized charges or changes to personal information.
• Report any suspicious activity to the Federal Trade Commission and local law enforcement.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How many people were affected by the CenterPoint Energy breach?

Over 1 million Texas residents were affected, with the total number including potential customers in other states remaining unclear.

What kind of personal information was stolen?

The breach compromised names, addresses, Social Security numbers, and driver’s license numbers.

Did CenterPoint Energy know about the breach before the hacker posted?

No, the company confirmed it learned of the breach after the threat actor posted on a cybercrime forum.