Skip to content
Today
Sections

Security Independently confirmed2 publishers 2 min read Published

CenterPoint Energy reports 1,062,060 Texans had Social Security and license numbers compromised

CenterPoint Energy told the Texas Attorney General that a breach compromised Social Security and driver's license numbers of 1,062,060 Texans. A forum actor claimed 7.49 million records; the all-state total is unclear.

The Watch · Security desk

Send a correction

Illustration accompanying CenterPoint Energy reports 1,062,060 Texans had Social Security and license numbers compromised
Generated illustration
The hacker's claim and the Texas count differ What CenterPoint told Texas, set beside what a forum actor claimed and what the leaked archive seemingly holds.

Three figures: roughly 7.49 million customer records a forum actor claimed to extract from CenterPoint Energy; 1,062,060 Texas residents affected, per CenterPoint's notice to the Texas Attorney General; approximately 3 million phone numbers the archive seemingly holds.

The hacker's claim and the Texas count differ
FigureValueNoteClaim
Customer records the forum actor claimed, roughly7,490,000 records10
Texas residents affected, per CenterPoint1,062,060 residentstold to the Texas Attorney General1
Phone numbers the archive seemingly holds, approximately3,000,000 phone numbersper SecurityWeek12

What happened

  • The Texas notice came one month after CenterPoint told the SEC that customer information had been stolen from its systems.
  • In that SEC filing the company said it learned of the breach after the threat actor's public post.
  • On September 12 the actor made a 2.5 GB archive available for download, SecurityWeek reported.

Why it matters

  • Who's exposed exposure The all-state total is at least the Texas figure. Indiana, Minnesota and Ohio customers have no published count, so the exposure for those states is open.
  • What doesn't add up contradiction The state filing lists driver's license numbers, and the actor's claimed field list does not. The post cannot be used to size what Texans lost.
  • Who's exposed exposure Affected customers appear to have no individual notice so far. The company says it is still identifying who will be notified.

The 1,062,060 figure covers Texas only. SecurityWeek reported that CenterPoint also delivers electricity and natural gas in Indiana, Minnesota and Ohio, that residents of those states might be affected as well, and that the total impact remains unclear [6].

The count does not confirm or refute the forum actor's number. It equals about 14% of the 7.49 million records the actor claimed [9], but one figure counts people in one state [1] and the other counts customer records claimed on a forum on September 12 [10].

The field lists differ too. The actor listed names, phone numbers, service and billing addresses, account numbers, billing amounts, payment status and partial Social Security numbers [16]. The company's filing, as SecurityWeek describes it, lists names, addresses, Social Security numbers and driver's license numbers [2]. Driver's license numbers are not on the actor's list as reported. SecurityWeek said the archive seemingly contains approximately 3 million phone numbers along with additional personal information [12].

The company's own account is narrow. Its SEC filing said: "While the investigation remains ongoing, the Company has determined that an unauthorized third party obtained personal information relating to a portion of the Company's customers through one of the Company's external facing systems" [3].

Everything about method comes from the actor. The actor claimed the data left through an API without proper WAF protection, rate limiting or authentication, and that the company tried to stop the dump only after millions of records had been extracted [14].

A CenterPoint spokesperson said on Wednesday: "We continue to work with third-party experts to assess the scope of affected customer data to identify which customers will be provided notifications in accordance with applicable legal requirements." [7] SecurityWeek reported that it appears the utility has not sent notification letters [13].

The actor also wrote that "next time we won't simply pull data, we'll start attacking the main infrastructure" [15]. That is a forum statement. The company's SEC filing said the incident did not impact its operations [8].

What to watch

  • Whether CenterPoint sends notification letters and says how many customers outside Texas are covered.
  • Breach counts filed by Indiana, Minnesota or Ohio, which would show whether the total moves past 1,062,060.
  • Whether the company confirms or disputes the actor's API account and the 7.49 million record claim; SecurityWeek has asked for clarification.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence58
Adoption
Not scored
Hype gap+10
Incentives
Not scored
Confidence62
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    CenterPoint Energy told the Texas Attorney General's Office this week that the breach affected 1,062,060 Texas residents.

    Reported Supported Source: Security AffairsView cited source
  2. [2]

    According to the company's filing, the compromised information includes names, addresses, Social Security numbers, and driver's license numbers.

    Reported Supported Source: SecurityWeekView cited source
  3. [3]

    CenterPoint's Form 8-K said: "While the investigation remains ongoing, the Company has determined that an unauthorized third party obtained personal information relating to a portion of the Company's customers through one of the Company's external facing systems."

    Reported Supported Source: CenterPoint Energy Form 8-K filed with the SEC, quoted by Security AffairsView cited source
  4. [4]

    In its SEC filing, the company confirmed it learned of the data breach after the threat actor's public post.

    Reported Supported Source: SecurityWeekView cited source
  5. [5]

    The notice to Texas authorities came one month after the Houston-based public utility told the SEC that customer information had been stolen from its systems.

    Reported Supported Source: SecurityWeekView cited source
  6. [6]

    CenterPoint Energy also delivers electricity and natural gas to customers in Indiana, Minnesota, and Ohio, and residents of those states might have been affected as well; the total impact from the incident remains unclear.

    Reported Supported Source: SecurityWeekView cited source
  7. [7]

    A CenterPoint spokesperson said on Wednesday: "We continue to work with third-party experts to assess the scope of affected customer data to identify which customers will be provided notifications in accordance with applicable legal requirements."

    Reported Supported Source: CenterPoint Energy spokesperson, quoted by Security AffairsView cited source
  8. [8]

    The company's SEC filing noted that only a portion of its customers had been affected and that the incident did not impact its operations.

    Reported Supported Source: SecurityWeekView cited source
  9. [9]

    The Texas count of 1,062,060 is about 14% of the roughly 7.49 million records the forum actor claimed.

    Derived Supported
  10. [10]

    On September 12, days before the first disclosure, a threat actor using the alias 4d722e4d656f77 claimed on a cybercrime forum to have extracted roughly 7.49 million customer records from CenterPoint Energy.

    Reported Insufficient Source: Security AffairsView cited source
  11. [11]

    On September 12, the hacker made a 2.5-gigabyte archive available for download, allegedly containing data exfiltrated from the utility.

    Reported Insufficient Source: SecurityWeekView cited source
  12. [12]

    The archive file seemingly contains approximately 3 million phone numbers along with additional personal information.

    Reported Insufficient Source: SecurityWeekView cited source
  13. [13]

    It appears that the utility has not sent notification letters to the impacted individuals.

    Reported Insufficient Source: SecurityWeekView cited source
  14. [14]

    The attackers claimed they stole the records through an API they say lacked proper WAF protection, rate limiting, and authentication, and claimed the company tried to stop the data dump only after millions of records had been extracted.

    Reported Insufficient Source: Security Affairs, relaying the attackers' claimsView cited source
  15. [15]

    The attacker warned that "next time we won't simply pull data, we'll start attacking the main infrastructure."

    Reported Insufficient Source: Threat actor, quoted by Security AffairsView cited source
  16. [16]

    The hacker claimed the theft of names, phone numbers, service and billing addresses, account numbers, billing amounts, payment status, and partial Social Security numbers.

    Reported Insufficient Source: Security Affairs, relaying the hacker's claimsView cited source

Sources

2 independent publishers whose own reporting we read for this story.

  1. securityaffairs.com

    1 article · October 16, 2026

    CenterPoint Energy Data Breach: More Than 1 Million Texans Affected
  2. securityweek.com

    1 article · October 15, 2026

    CenterPoint Energy Data Breach Impacts 1 Million Texans

Topics and entities

Topics

Entities