CenterPoint Energy and Burger King Japan data breaches: what to check
A ConnectWise Cloud Backup credential compromise, a CenterPoint Energy breach affecting more than 1 million Texas residents and an 11.18 million-member breach at Burger King Japan lead the 19 October weekly bulletin from Check Point Research. Nothing in the bulletin ties these incidents together, and it does not say whether the ConnectWise credentials are still usable.
What we know
- ConnectWise Cloud Backup: the Microsoft 365 backup service, used by managed service providers, suffered a credential compromise. Check Point reports attackers used compromised application credentials to sign in to at least 173 organizations, potentially reaching email, files and Teams information, before access was suspended.
- CenterPoint Energy: the US utility serving Texas and other states disclosed unauthorized access to an external system. According to its regulatory notifications, names, addresses, Social Security information and driver’s license numbers were exposed for more than 1 million Texas residents.
- Burger King Japan: access between October 2 and 7 exposed contact information, birth dates, gender and regional details for roughly 11.18 million application members. The company found no evidence that passwords or payment cards were compromised.
- French supermarkets: several stores, including E. Leclerc, were reportedly hit through connected refrigeration controllers. Attackers reportedly changed temperature settings, causing refrigeration failures and food losses; one retailer’s losses exceeded $100,000.
Who is affected
The ConnectWise incident matters most to managed service providers and their customers, because a backup service with delegated Microsoft 365 access can expose many tenants at once. Which organizations were among the 173 has not been disclosed in the bulletin.
CenterPoint and Burger King Japan affect individuals. The CenterPoint data (Social Security and driver’s license numbers) supports identity theft and targeted phishing. The Burger King Japan data is lower in sensitivity, but names, contact details and birth dates are useful for convincing phishing.
Why this matters
Analysis, not reported fact: the ConnectWise case is a supply-chain pattern. The attackers did not need to break each victim; they used application credentials that already had access. Any third-party app with broad Microsoft 365 permissions is a similar single point of failure. The refrigeration attacks show that internet-reachable operational controllers face the same exposure in retail settings.
What has not been confirmed
- How the ConnectWise application credentials were obtained.
- The names of the 173 organizations and what data was actually accessed, as opposed to potentially accessible.
- How attackers reached the CenterPoint external system or the refrigeration controllers.
- Who is behind any of these incidents. The bulletin names no attackers.
What to do
- If you use ConnectWise Cloud Backup, or your MSP does, ask for written confirmation of whether your tenant was among those accessed, and rotate any credentials or app secrets tied to the service.
- Review Microsoft 365 enterprise application consents and service principal sign-in logs for unfamiliar locations or activity outside backup windows.
- Apply least privilege to third-party apps and remove integrations you no longer use.
- If you are a notified CenterPoint customer, consider a credit freeze and treat unexpected calls or messages about your account as suspect. Burger King Japan app users should watch for phishing that uses their personal details.
- Check that building and refrigeration controllers are not exposed to the internet, and that default credentials are changed.
Other items in the bulletin
The same bulletin reports that Check Point researchers found critical flaws in the LiteLLM AI gateway, tracked as CVE-2026-35029 and CVE-2026-59823. Low-privileged users could change configurations, read sensitive files, redirect requests and steal credentials, with administrative takeover or remote code execution possible. LiteLLM has addressed both; confirm your deployment is updated.
Related free tool: test how long a password would take to crack with our Password Strength Checker. It runs entirely in your browser and nothing you type is sent or stored.