CenterPoint Energy, the Houston-based utility that delivers electricity and natural gas to roughly 7 million customers across Texas, Indiana, Minnesota, and Ohio, has confirmed a data breach affecting an unknown portion of its customer base. The company disclosed the incident in a Form 8-K filed with the Securities and Exchange Commission on September 14, 2026, after a threat actor posted claims online that a dataset containing millions of CenterPoint customer records had been stolen and put up for sale.
The disclosure has been picked up by outlets including ABC13 Houston, Click2Houston, and FOX 26 Houston, alongside national cybersecurity press such as BleepingComputer and SecurityWeek. The story has quickly become one of the most-searched cybersecurity headlines of the week, and for good reason: a breach at a regulated utility touches customers who have no choice but to hand over their personal and billing information just to keep the lights on.
What Happened: CenterPoint Energy Confirms a Data Breach
According to the company’s SEC filing, CenterPoint became aware in September 2026 of an online post from a third party claiming to have obtained a dataset containing customer information. An investigation determined that an unauthorized party had accessed personal information belonging to a portion of CenterPoint’s customers through one of the company’s external-facing systems. CenterPoint has stressed that the intrusion did not touch the systems that control electricity or natural gas delivery, and that service to customers has not been disrupted.
The company has not confirmed the full scope of the breach, saying instead that it is still working with outside cybersecurity specialists to determine exactly which customers and which categories of data were involved. That distinction matters: CenterPoint is confirming that a breach occurred and that customer data was accessed, while explicitly declining to confirm the specific record count that a hacker has publicized. This is a common pattern in 2026 breach disclosures, where companies acknowledge unauthorized access quickly to satisfy SEC materiality rules, then spend weeks or months on forensic work before issuing a final tally.
Timeline: From a Dark Web Post to an SEC Filing
Reporting from The Record, the news arm of Recorded Future, and The Register lays out a timeline that starts on September 1, 2026, when a threat actor using the online handle 4d722e4d656f77 posted on an open web forum claiming to have obtained a database tied to CenterPoint customers. The actor described the source as an API operated by the company and alleged the endpoint lacked adequate authentication and rate limiting, allowing the data to be pulled at scale.
CenterPoint’s SEC filing followed on September 14, thirteen days after the initial forum post, putting the company’s public disclosure inside the window regulators generally expect once a breach is determined to be material or once law enforcement clears public notice. The gap between the forum post and the formal filing gave researchers and journalists time to examine the leaked samples before CenterPoint’s own statement caught up with the story circulating in security circles.
How Many Customers Are Affected? The 7.49 Million Question
The number driving most of the coverage is 7.49 million. That is the figure the threat actor claimed for raw records, alongside a smaller set of 6.73 million records described as filtered or deduplicated. CenterPoint has not confirmed either number, and the company has explicitly said it cannot yet verify the authenticity of the published dataset. Given that CenterPoint serves close to 7 million customer accounts in total, a claim of 7.49 million raw records would imply the leak, if fully authentic, could touch a large share of the utility’s entire customer base, though duplicate entries, historical accounts, and formatting artifacts commonly inflate raw record counts well above the number of actual individuals affected.
This is the same pattern security reporters flagged with the IDScan.net breach earlier this year, where an initial hacker claim of 150 million identity records took weeks of company forensic review before a narrower, confirmed figure emerged. CenterPoint appears to be following the same cautious playbook: acknowledge the intrusion, decline to validate the attacker’s number, and promise formal notifications once the internal review concludes.
What Customer Data Was Exposed
Based on the sample the threat actor posted and reviewed by multiple outlets, the alleged dataset includes customer names, phone numbers, email addresses, service and billing addresses, account and premise identifiers, billing amounts, payment status, autopay and paperless billing enrollment, and the last four digits of Social Security numbers. That is not a password dump or a credential leak in the traditional sense. It is the kind of account and billing metadata that utilities accumulate simply by serving customers for years, which makes it valuable for identity-theft and social-engineering schemes rather than for direct account takeover.
Partial Social Security numbers, on their own, are not enough to open new lines of credit. Combined with a full name, billing address, phone number, and account number, though, they give scammers exactly what they need to run convincing utility-impersonation phishing calls, a scam type that spikes every time a major utility discloses a breach. Customers should expect a wave of calls and texts claiming to be from CenterPoint over the coming weeks, and the company’s own billing data makes those calls easier to fake convincingly.
How the Breach Reportedly Happened: An Exposed API
The attacker’s own account of the incident, as relayed by The Register, points to an internet-facing API that allegedly lacked sufficient authentication and rate-limiting controls, allowing bulk extraction of customer records rather than a single stolen credential or a targeted phishing compromise. CenterPoint’s own filing is less specific, describing only that an unauthorized third party obtained information “through one of the Company’s external-facing systems,” without naming the API or confirming the attacker’s technical narrative.
If the attacker’s version holds up under CenterPoint’s own investigation, this breach fits a pattern that has become depressingly familiar in 2026: not a sophisticated zero-day, but a public-facing endpoint that was reachable without the rate limits, authentication checks, or anomaly detection that would normally catch someone scraping millions of records in a short window. Exposed and under-protected APIs have become one of the most common root causes behind large-scale consumer data breaches this year, precisely because they sit at the intersection of convenience (self-service customer portals, mobile apps, partner integrations) and exposure (public internet reachability).
CenterPoint’s Official Response So Far
CenterPoint says it activated its cybersecurity incident response protocols as soon as it became aware of the forum post, brought in outside cybersecurity specialists to assist with the investigation, and has taken additional steps to protect its systems. The company has also notified law enforcement and certain regulators, and says it intends to notify affected customers and any additional required authorities once it has determined the full scope of the incident, consistent with state breach-notification laws that generally require covered entities to alert impacted residents within a defined window after confirming a breach.
Crucially, CenterPoint has repeated across every version of its statement that electric and natural gas delivery has not been affected and remains fully operational. That separation between “customer data was accessed” and “the grid is fine” is deliberate messaging, aimed at reassuring the roughly 7 million households and businesses who rely on CenterPoint for power and heat that this is a data-privacy incident, not an operational-technology or grid-safety one.
Market and Financial Impact for CenterPoint (NYSE: CNP)
In its 8-K, CenterPoint stated that, as of the filing date, it does not believe it is reasonably likely that the incident will have a material impact on the company’s financial condition or results of operations. That is standard boilerplate language for breach disclosures and should not be read as a guarantee; it is a snapshot judgment made before litigation costs, regulatory penalties, or expanded notification obligations are known. Regulated utilities like CenterPoint also carry an added layer of exposure that purely commercial companies don’t: state utility commissions can weigh cybersecurity practices into rate-case reviews, meaning a breach can resurface months later in a completely different regulatory proceeding tied to what customers pay on their bills.
Investors have seen this movie before. When AT&T disclosed its 2024 breaches affecting 73 million and later close to 109 million customers, the company ultimately agreed to a $177 million settlement in 2025 to resolve the resulting lawsuits. CenterPoint’s claimed exposure is smaller in scale, but the legal and reputational playbook that follows a confirmed utility or telecom breach tends to look similar regardless of company size: class actions filed within days, a multi-year settlement process, and years of credit-monitoring offers bundled into the eventual resolution.
Legal Fallout: Class Actions and Law Firm Investigations
Plaintiffs’ law firms moved almost immediately. Edelson Lechtzin LLP announced an investigation into the breach and the exposure of CenterPoint customer personal information, according to a PRNewswire release, and multiple proposed class-action complaints have already been filed against the company over the alleged breach. This is now a near-automatic response to any breach disclosure involving Social Security number fragments and utility billing data: plaintiffs’ firms compete to be named lead counsel, complaints get consolidated, and the case typically proceeds toward a negotiated settlement rather than trial, following the same trajectory seen in the AT&T, Change Healthcare, and National Public Data litigation of the past two years.
For affected customers, the practical value of these lawsuits is usually a future claims process offering free credit monitoring or a modest cash payment years down the line, not immediate compensation. The more urgent protective step is monitoring accounts and credit reports directly, rather than waiting on litigation to resolve.
CenterPoint Energy Data Breach: Key Facts at a Glance
| Detail | What’s Known |
|---|---|
| Company | CenterPoint Energy Inc. (NYSE: CNP), Houston, Texas |
| Customers served | Approximately 7 million electric and natural gas customers across Texas, Indiana, Minnesota, and Ohio |
| SEC disclosure date | September 14, 2026 (Form 8-K) |
| Threat actor’s claim | 7.49 million raw records / 6.73 million filtered records, posted September 1, 2026 |
| Confirmed by CenterPoint? | No — company has not verified the attacker’s figure or dataset authenticity |
| Alleged data types | Names, phone numbers, emails, service/billing addresses, account and premise IDs, billing amounts, payment status, autopay status, partial Social Security numbers |
| Alleged entry point | An external-facing company system / API, per the attacker’s own claims |
| Service impact | None reported — electric and gas delivery remain operational |
| Law enforcement notified | Yes, along with certain regulators |
| Legal action | Multiple proposed class actions filed; Edelson Lechtzin LLP investigation announced |
How This Compares to Other Major 2026 Data Breaches
CenterPoint’s breach is significant, but it is far from the largest data-exposure event of the past two years, and comparing it against other recent incidents helps put the 7.49 million figure into perspective. The IDScan.net breach disclosed earlier in 2026 involved an initial hacker claim in the range of 150 million identity records tied to enterprise clients, while the 2024 National Public Data breach saw hackers claim 2.9 billion raw records, later narrowed to roughly 272 million actual individuals affected once the company confirmed the incident. AT&T’s 2024 breaches, by contrast, involved confirmed figures of 73 million and close to 109 million customers respectively, both fully acknowledged by the company rather than left as an unverified attacker claim.
What sets CenterPoint apart so far is the gap between the attacker’s number and the company’s own silence on scope. Other breaches this year involving personal data, including the Florida DMV login breach and the Trezor breach linked to a Brevo phishing compromise, followed a similar pattern of an early unverified claim followed by a narrower company-confirmed count weeks later. CenterPoint customers should expect the same delay before an authoritative number arrives.
| Breach | Year Disclosed | Records Claimed / Confirmed | Status |
|---|---|---|---|
| CenterPoint Energy | 2026 | 7.49M raw claimed (unconfirmed) | Under investigation |
| IDScan.net | 2026 | ~150M claimed initially | Confirmed, narrower scope later |
| National Public Data | 2024 | 2.9B raw claimed / ~272M individuals | Confirmed |
| AT&T (dark web leak) | 2024 | 73M customers | Confirmed, $177M settlement in 2025 |
| AT&T (Snowflake-linked) | 2024 | ~109M customers | Confirmed, part of same settlement |
Why Utilities Have Become a Prime Target
Utility companies occupy an unusual position in the breach landscape. Customers cannot opt out of sharing personal and billing data with their power or gas provider the way they might avoid a retailer or a social network, which means utility databases accumulate years of stable, high-confidence personal information: names tied to real addresses, real phone numbers, real payment histories. That makes utility data especially useful for identity theft and for crafting convincing phishing and vishing campaigns, since a scammer who already knows a target’s account number and last bill amount sounds far more credible impersonating “CenterPoint billing” than a random caller claiming to be from a bank.
Utilities also tend to run large portfolios of legacy billing systems alongside newer customer-facing apps and APIs, often the product of mergers, regional subsidiaries, and decades of incremental IT investment. CenterPoint itself operates across four states with different regulatory regimes, which historically has meant integrating multiple back-end systems rather than a single unified platform. That kind of sprawl is exactly the environment where an under-protected external API can go unnoticed until a hacker finds it first.
What CenterPoint Customers Should Do Right Now
- Treat any unexpected call, text, or email claiming to be from CenterPoint Energy with suspicion, especially ones asking to “verify” an account number, billing amount, or Social Security number.
- Never click payment links sent by text message. CenterPoint’s official channels do not need customers to confirm account details that a scammer using leaked billing data might already appear to know.
- Watch bank and credit card statements for small unauthorized test charges, which are frequently used to validate stolen payment details before larger fraud attempts.
- Consider placing a fraud alert or credit freeze with the major credit bureaus if CenterPoint confirms Social Security number exposure in your specific case once formal notifications go out.
- Save any breach notification letter or email from CenterPoint, since it may be required to participate in future class-action settlement claims.
Historical Context: A Pattern Regulators Are Watching Closely
The SEC’s 2023 cybersecurity disclosure rules, which require public companies to report material breaches within four business days of determining materiality, have fundamentally changed how incidents like CenterPoint’s reach the public. Before those rules took effect, a company could sit on a breach for weeks or months before any formal disclosure. Now, an 8-K filing arrives while the company is still mid-investigation, which is exactly why CenterPoint’s filing reads as cautious and incomplete rather than final. Expect an amended 8-K or a follow-up statement once the forensic review concludes, a pattern that played out with both AT&T’s 2024 disclosures and the IDScan.net breach earlier this year.
This is also not the first time a major U.S. utility or energy company has faced scrutiny over customer or systems security. Utility-sector cybersecurity has drawn sustained attention from the Department of Energy and CISA over the past several years, largely focused on protecting operational technology and grid control systems from nation-state actors. CenterPoint’s breach is different in nature, a customer-data exposure through a business-side system rather than an attack on grid operations, but it will still add to the broader argument that critical infrastructure operators need to treat customer-facing IT with the same rigor as their operational networks.
Predictions: What Happens Next
- CenterPoint will likely issue a follow-up disclosure or amended 8-K within four to eight weeks narrowing the confirmed record count, probably below the attacker’s claimed 7.49 million figure, consistent with how similar 2026 breach investigations have concluded.
- Expect the number of proposed class-action lawsuits to climb into the double digits within a month, following the same consolidation pattern seen with the IDScan.net and AT&T litigation.
- State regulators in at least one of CenterPoint’s four service territories will likely open a formal inquiry into the utility’s cybersecurity practices, given the heightened scrutiny utilities face post-breach.
- CenterPoint will almost certainly offer free credit monitoring to affected customers once formal notifications go out, mirroring the standard remediation package used across 2024 to 2026 breach disclosures.
- Other regional utilities are likely to face increased phishing and social-engineering attempts in the coming months, as CenterPoint’s exposed billing-data format gives scammers a proven template to adapt against other providers’ customers.
The Bigger Picture for Critical Infrastructure Cybersecurity
CenterPoint’s breach adds to a growing list of 2026 data breaches hitting sectors that customers cannot easily avoid, from DMVs to identity-verification vendors to now a regional utility. Each of these incidents reinforces the same lesson: the weakest link is rarely the flashiest system. It’s the quieter, external-facing API or portal that handles routine customer requests, exactly the kind of system that gets less security budget than headline-grabbing operational technology, yet holds just as much sensitive personal data. Expect this breach to be cited in coming months alongside cases like the Dropbox-Lenovo SSO breach and the Revolut fake-government-email breach as examples pushing companies toward stricter API authentication and rate-limiting standards.
For now, the most important number in this story remains unverified. CenterPoint says a breach happened; the hacker says 7.49 million records were taken; and the truth, as usual with breach disclosures under the SEC’s four-day rule, will likely land somewhere in between once the forensic dust settles.
Frequently Asked Questions
Did CenterPoint Energy confirm a data breach?
Yes. CenterPoint Energy confirmed in a September 14, 2026 SEC filing that an unauthorized third party obtained personal information belonging to a portion of its customers through one of the company’s external-facing systems.
How many CenterPoint Energy customers were affected?
A threat actor claimed to have stolen 7.49 million raw customer records and 6.73 million filtered records. CenterPoint has not confirmed this figure or verified the authenticity of the leaked dataset.
What information was exposed in the CenterPoint Energy breach?
The alleged dataset reportedly includes customer names, phone numbers, email addresses, service and billing addresses, account and premise identifiers, billing amounts, payment status, autopay enrollment, and the last four digits of Social Security numbers.
Is CenterPoint Energy’s electric and gas service affected?
No. CenterPoint has stated repeatedly that the breach involved customer data systems only, and that electricity and natural gas delivery remain operational and undisrupted.
How did hackers reportedly access CenterPoint’s data?
The threat actor claimed the data came from an external-facing API that allegedly lacked adequate authentication and rate limiting. CenterPoint’s own filing confirms an external-facing system was involved but has not named the specific point of entry.
Has CenterPoint Energy been sued over the data breach?
Yes. Multiple proposed class-action lawsuits have been filed against CenterPoint, and law firm Edelson Lechtzin LLP has announced an investigation into the breach.
What should CenterPoint Energy customers do to protect themselves?
Customers should be wary of unsolicited calls, texts, or emails claiming to be from CenterPoint, avoid clicking payment links sent via text, monitor bank and credit statements for unauthorized charges, and watch for an official breach notification letter confirming whether their specific data was affected.
When will CenterPoint confirm the final number of affected customers?
CenterPoint has not given a timeline, saying only that it is continuing to investigate the scope of the incident with outside cybersecurity experts and will notify affected customers and regulators once that work is complete.
