CenterPoint Energy says a data breach exposed personal information belonging to 1,062,060 Texas residents, including names, addresses, Social Security numbers and driver’s-license numbers. The figure appears in a report filed with the Texas Attorney General’s Office, which indicated that affected customers had not yet been notified when the filing was submitted.
The Houston-based utility first disclosed the incident in a Sept. 14 filing with the U.S. Securities and Exchange Commission. CenterPoint said it learned of an online post by a third party claiming to possess customer data, then activated its incident-response procedures, engaged outside cybersecurity and forensic specialists, and took steps to protect its systems.
According to the SEC filing, an unauthorized third party obtained personal information through one of CenterPoint’s external-facing systems. The company has not publicly identified a vulnerability, CVE, exploit method or threat actor, and there is no verified evidence that the incident involved ransomware or a broader compromise of the electric grid. CenterPoint said its electric and natural-gas delivery services remain operational and undisrupted.
Reports citing the attacker’s online claims have described a dataset containing as many as 7.49 million records and potentially including account, billing and partial Social Security information. That larger figure remains an unverified claim and should not be treated as the confirmed number of affected people. The Texas filing provides the current confirmed count for residents covered by that report, while the company continues to determine which individuals and categories of information require notification.
The exposure of Social Security and driver’s-license information creates a heightened risk of identity theft and targeted fraud even though the incident has not disrupted utility operations. Texas law generally requires organizations to report breaches affecting at least 250 state residents to the attorney general and notify affected individuals without unreasonable delay, subject to statutory deadlines. CenterPoint said it reported the matter to law enforcement and intends to notify customers and regulators as required.
Customers who receive a notice should use contact details provided through CenterPoint’s official website rather than links in unsolicited messages, monitor account and credit activity, and consider a credit freeze or fraud alert with the major credit bureaus. Until CenterPoint publishes a final notification or technical postmortem, defenders should treat claims about the stolen dataset, the initial access route and any alleged attacker identity as unconfirmed.
