Privacy
CenterPoint Energy Data Breach Exposes Personal Data of Over 1 Million Texans
CenterPoint Energy has reported a data breach affecting more than 1 million Texans, with names, addresses, Social Security numbers, and driver’s licence numbers exposed. The full impact is still unclear.
Ross Grant3 min read
The short version
CenterPoint Energy, a major utility provider, has suffered a data breach that exposed the personal information of over 1 million Texans. The stolen data includes sensitive details like Social Security numbers and driver’s licence numbers. The company has told authorities but has not yet notified affected customers directly. It is not yet clear if people in other states are also affected.
By the numbers
- 1,062,060Texans affected by the breachSecurityWeek
- 7.5 millionRecords the hacker claims to have stolenSecurityWeek
- 2.5GBSize of leaked data archiveSecurityWeek
- 3 millionPhone numbers reportedly in the leaked fileSecurityWeek
What happened?
CenterPoint Energy has reported a data breach affecting over 1 million Texans. Personal information such as names, addresses, Social Security numbers, and driver’s licence numbers was compromised. The breach was first revealed after a hacker posted stolen data on a cybercrime forum. The company has notified Texas authorities but has not confirmed the total number of people affected or whether customers in other states are impacted.
What is known so far
CenterPoint Energy, a major utility provider based in Houston, has reported a significant data breach. According to SecurityWeek (opens in a new tab), the company notified Texas authorities that over 1 million state residents had their personal information compromised. The breach included sensitive data such as names, addresses, Social Security numbers, and driver’s licence numbers.
The breach first came to light after a hacker posted on a cybercrime forum, claiming to have obtained nearly 7.5 million user records from CenterPoint Energy. The company later confirmed in a filing to the US Securities and Exchange Commission (SEC) that customer data had been stolen, but said the incident did not affect its operations.
Timeline of the incident
- Early September 2026: A hacker posted on a cybercrime forum, claiming to have stolen millions of records from CenterPoint Energy.
- September 12, 2026: The hacker released a 2.5GB archive, allegedly containing data from the breach. The file reportedly included around 3 million phone numbers and other personal details.
- Mid-September 2026: CenterPoint Energy disclosed the breach to the SEC, stating that only a portion of customers were affected.
- October 2026: The company notified the Texas Attorney General’s Office that 1,062,060 residents were impacted. It is not clear if individuals have been directly notified yet.
Who is affected
The confirmed number of affected Texans is just over 1 million. CenterPoint Energy also serves customers in Indiana, Minnesota, and Ohio. The company has not confirmed whether residents in those states were affected, and the total number of impacted individuals remains unclear.
The compromised information is highly sensitive. Names, addresses, Social Security numbers, and driver’s licence numbers can all be used for identity theft or fraud. The hacker’s claim of 7.5 million records and the release of a 2.5GB file with millions of phone numbers suggest the breach could be larger, but only the Texas figures have been confirmed so far.
What CenterPoint Energy has said
CenterPoint Energy’s SEC filing acknowledged the breach after the hacker’s public post. The company stated that only a portion of its customers were affected and that its operations were not disrupted. As of the latest report, CenterPoint has not sent notification letters to affected individuals. SecurityWeek has contacted the company for further clarification, but no additional details have been released.
What you should do if you may be affected
If you are a CenterPoint Energy customer in Texas, your personal data may have been exposed. Watch for any official notification from the company. In the meantime, consider monitoring your credit reports and bank accounts for unusual activity. Be cautious of phishing emails or phone calls that reference your personal information. If you believe your Social Security number or driver’s licence number has been compromised, you may want to place a fraud alert or credit freeze with the major credit bureaus.
What happens next
It is possible that regulators could investigate the breach further, especially if residents in other states are found to be affected. Under US law, most states require companies to notify affected residents after a data breach. The maximum penalties can be significant if regulators find that CenterPoint did not take adequate steps to protect personal data or to notify customers promptly.
SecurityWeek is awaiting further comment from CenterPoint Energy. The full scale of the breach, and whether more people are affected outside Texas, is still not clear.
Claimed vs confirmed
- Unconfirmed
Hacker claims to have stolen 7.5 million user records from CenterPoint Energy.
The hacker made this claim on a cybercrime forum. CenterPoint has only confirmed over 1 million Texans affected.
- Confirmed
Only a portion of CenterPoint customers were affected.
CenterPoint stated this in its SEC filing.
- Confirmed
The breach did not impact CenterPoint's operations.
CenterPoint stated this in its SEC filing.
The impact
- Money
- The breach could lead to regulatory investigations and possible fines. In the US, data protection laws require notification of affected residents and can impose significant penalties if companies fail to protect personal data or notify customers promptly.
- Reputation
- CenterPoint Energy’s reputation may suffer, especially if more customers are found to be affected or if notification is delayed. As a utility provider, trust is critical.
- Customers
- Customers face a risk of identity theft and fraud due to the exposure of Social Security and driver’s licence numbers. They should monitor their accounts and be alert for scams or phishing attempts.
Why it matters
More than 1 million people have had sensitive personal information exposed, putting them at risk of identity theft and fraud. The breach affects a major utility provider, raising concerns about the security of essential service companies and the protection of customer data.
How does it work?
The breach involved unauthorised access to CenterPoint Energy’s systems, resulting in the theft of personal data. The method used by the attacker has not been disclosed.
Key points
- Over 1 million Texans had personal data exposed in a breach at CenterPoint Energy.
- Sensitive information stolen includes Social Security and driver’s licence numbers.
- The breach was first revealed by a hacker on a cybercrime forum.
- The total number of affected people may be higher, but only Texas figures are confirmed.
- Customers should monitor their accounts and watch for official notifications.
Sources
SecurityWeek
Reference
