-
CenterPoint told Texas officials that 1,062,060 residents had names, addresses, Social Security numbers, and driver’s license numbers stolen.
-
The company learned of the theft from a hacker’s online post. It had not notified customers when it filed the state report.
-
Customers in Indiana, Minnesota, and Ohio might be affected too. The full count is still unknown.
CenterPoint Energy says a data breach hit more than 1 million Texans. The Houston utility gave the number to the Texas Attorney General’s Office this week.
That report came a month after the company told the Securities and Exchange Commission (SEC) about the stolen customer data. So far, the company has not said how many people the breach affected nationwide.
The Scope of the Breach and How It Came to Light
The state’s breach database lists 1,062,060 Texas residents. The stolen information includes names, home addresses, Social Security numbers, and driver’s license numbers. This information is sufficient for opening accounts in somebody’s name.
CenterPoint had not yet notified those customers when it filed the report. Texas law sets two deadlines. Companies must report a breach affecting 250 or more residents within 30 days of finding it. They must also notify consumers within 60 days of confirming it. The state warns that the count and notice status may change.
CenterPoint did not catch the theft on its own. On September 12, a hacker bragged on a cybercrime forum about taking nearly 7.5 million customer records. Two days later, the company filed a report with the SEC. In it, CenterPoint said it learned of the incident from the hacker’s public post.
The company said an outside party reached customer data through one of its internet-facing systems. It added that the breach touched only a portion of its customers. CenterPoint also said the breach has not disrupted its electric or natural gas service.
The Hacker’s Claims
The hacker posts under the alias 4d722e4d656f77. They say the records came from a company system with no login protection. CenterPoint has not confirmed that account. It has not confirmed the 7.5 million figure either. Still, the claims offer a possible look at how the theft worked.
The reported theft has also drawn attention to the gap between a hacker’s claims and the number of affected people the company has confirmed. CenterPoint Energy says more than 1 million Texans may be affected, while the hacker claims to have stolen millions of customer records.
On September 12, the hacker also posted a 2.5-gigabyte file for download. It seemingly holds about 3 million phone numbers and other personal details. Security reporters say the hacker’s list also names emails, billing amounts, and account numbers. It lists the last four digits of Social Security numbers as well.
That detail matters. The Texas report lists Social Security numbers but does not say whether they are full or partial. Customers should not assume the smaller risk.
The hacker also says the company ignored its messages and treated them as a joke. The hacker also warned of a future attack on the company’s “main infrastructure.” CenterPoint says its power and gas services are running normally. The company has not linked the breach to any threat against its equipment.
Class Action Lawsuits Against CenterPoint and the Company’s Response
Lawsuits came fast. The Florida firm Shamis & Gentile filed three proposed class actions in federal court, according to a Houston Chronicle report. The complaints claim the breach happened between August 17 and September 1. CenterPoint has not confirmed those dates.
In a statement to the Houston Chronicle, CenterPoint said it is still investigating. Outside cybersecurity, forensic, and legal advisers are helping. The company is also deciding which customers will get notices. However, the statement did not say whether the Texas report covers the same incident it disclosed last month.
CenterPoint told investors it does not expect a major hit to its finances. It also says it reported the incident to law enforcement.
This is not the company’s first recent data problem. Last year, it said it was looking into a separate breach. That one traced back to a 2023 theft through a file-sharing platform, The Record reported.
Other Potential Victims and Possible Next Steps
About 7 million people in Indiana, Minnesota, Ohio, and Texas use CenterPoint. People in the three other states might have lost data too. However, the company has not shared totals for them. Until this happens, it will remain unknown how serious the breach really is.
You are not required to wait for a notice letter. First, put freezes on your credit at Equifax, Experian, and TransUnion. Freezes are free of charge and help block scammers from opening new accounts in your name.
Also, monitor your credit report and check bank statements to catch suspicious activities such as account openings, charges and inquiries you didn’t authorize.
And, do not trust any calls, text messages, or emails coming from CenterPoint. Scammers may get your personal information through the breach and use it to try to defraud you. Also, never click links on expected emails or texts. Call the official company phone line or visit the website on your bill to verify.
Finally, keep the notice you received. It must give you an idea of the extent of your information that was breached. The credit freeze does not protect against all types of fraud, so watch your accounts anyway.
According to CenterPoint, it will notify affected customers and regulators about the breach as the law requires. For now, the full scope of the breach remains unclear.
