CenterPoint Confirms Customer Data Theft After Hacker’s 7.5m Claim

Texas utility CenterPoint Energy has confirmed that an unauthorised third party obtained personal information belonging to some of its customers. The Houston-based company, which supplies electricity and natural gas to roughly 7 million customers in Indiana, Minnesota, Ohio and Texas, disclosed the incident to the US Securities and Exchange Commission after learning that someone claimed to possess customer data.

CenterPoint said the information was obtained through one of its externally facing systems and that its investigation remains ongoing. It added that the incident has not affected electricity or gas delivery and is not expected to have a material impact on the company.

The disclosure followed a 12 September post on a cybercrime forum in which a hacker claimed to have stolen nearly 7.5 million user records and threatened future attacks on the utility’s infrastructure. The actor offered a 2.5 GB archive for download, allegedly containing CenterPoint data.

SecurityWeek said it could not verify the archive, noting that such claims can be false or exaggerated; the company’s filing confirms unauthorised access to some customer information but does not validate the hacker’s figures or claims about infrastructure threats. CenterPoint has not disclosed the types of information affected or identified the responsible actor.

The article also notes earlier claims involving CenterPoint in 2024 and subsequent months, which analysts believed were linked to third-party data exposure from the Cl0p ransomware group’s 2023 MOVEit campaign rather than a direct compromise of the utility’s systems.