CenterPoint Energy Investigates Alleged Theft of 7.49m Customer Records

CenterPoint Energy has confirmed that an unauthorised third party obtained personal information belonging to some of its customers through an external-facing system. The Houston-based utility, which serves about 7 million electricity and gas accounts across Texas, Indiana, Minnesota and Ohio, disclosed the incident in an SEC filing after a hacker advertised the alleged data online.

CenterPoint said its energy services were not affected, and that it is investigating the incident, assessing the information involved and preparing to notify customers, regulators and law enforcement as required.

On 12 September, a threat actor using the alias “4d722e4d656f77” claimed to have extracted roughly 7.49 million records and offered a 2.5 GB archive for download. The actor alleged that the data included names, phone numbers, service and billing addresses, account numbers, billing amounts, payment status and partial Social Security numbers, and said it was obtained through an API lacking adequate web application firewall protection, rate limiting and authentication.

However, CenterPoint has not confirmed the 7.49 million figure, the specific fields involved or the actor’s claims. Independent outlets have also been unable to fully validate the dataset, so the final scope may differ. Customers should watch for convincing phishing and fake billing messages using personal or account information; the company says it locked down systems after discovering the online post.