CenterPoint Energy data breach exposes SSNs of 1 million Texans
The CenterPoint Energy data breach has now been quantified: according to SecurityWeek, the Houston-based utility told the Texas Attorney General’s Office that 1,062,060 Texas residents had personal information compromised. The data includes Social Security numbers and driver’s license numbers, which makes identity theft the main risk. The company has said the incident did not affect its operations, and no CVE or software flaw has been disclosed.
What we know
- CenterPoint Energy first told the SEC that customer information had been stolen. SecurityWeek says this came about one month before the Texas notice.
- Days before that disclosure, a hacker boasted on a known cybercrime forum of holding nearly 7.5 million user records from the company.
- In its SEC filing, the company said it learned of the breach from the threat actor’s public post, and that only a portion of its customers were affected.
- This week, the company reported 1,062,060 affected Texas residents to the state Attorney General.
- According to the filing, the exposed data covers names, addresses, Social Security numbers and driver’s license numbers.
Who is affected
Confirmed victims so far are Texas residents. CenterPoint Energy also delivers electricity and natural gas to customers in Indiana, Minnesota and Ohio, so people in those states might be affected too. SecurityWeek reports that the total impact remains unclear, and it has asked the company how many people were affected.
SecurityWeek also notes that the utility appears not to have sent notification letters yet. If you are a customer, watch for a letter or email, but do not wait for one before taking protective steps.
What has not been confirmed
- The total number of people affected across all states: not disclosed.
- How the attacker got in: not disclosed.
- The hacker’s claim of 7.5 million records is unverified, and the company has said only a portion of its customers were affected.
- On September 12, the hacker reportedly made a 2.5-gigabyte archive available for download. It allegedly holds data taken from the utility and seemingly includes roughly 3 million phone numbers with other personal information. This is a claim and has not been confirmed by the company.
Why this matters
Analysis, not new facts. Social Security and driver’s license numbers cannot be changed easily, so the risk lasts for years rather than weeks. Because the data reportedly circulated publicly on a forum before the company disclosed it, affected people should assume criminals already have it. Names, addresses and phone numbers together are also useful for convincing phishing and phone scams that impersonate a utility, for example a call about an overdue bill or a disconnection threat.
For security teams at other utilities and large customer-facing firms, the disclosure sequence is a useful reminder: the company learned of the incident from a forum post, not from its own detection. Monitoring for your own brand and data on criminal forums can shorten that gap.
What to do
If you are a CenterPoint Energy customer:
- Place a free fraud alert or credit freeze with the credit bureaus, especially if your Social Security number may be exposed.
- Check your credit reports for accounts you do not recognise.
- Treat unexpected calls, texts or emails about your utility account as suspect. Contact the company using a number from a past bill, not from the message.
- Watch for a notification letter and read it for any offered protection services.
If you run security for an organisation:
- Warn staff who are customers about utility-themed phishing and vishing, and remind helpdesk staff to verify callers before resetting accounts.
- Add breach-themed lures to phishing awareness material.
- Set up brand and data-leak monitoring so you hear about a forum post before the press does.
- Review what personal data you keep, and how long, so a future breach exposes less.
We will update this article if the company confirms further details.
