CENTERPOINT Energy disclosed a data breach affecting more than one million Texas residents. The Texas Attorney General’s office lists 1,062,060 Texans as affected, with the compromised information reportedly including customers’ names, addresses, Social Security information, and driver’s license numbers.
A threat actor on a cybercrime forum claimed in September 2026 to have extracted roughly 7.49 million customer records from CenterPoint Energy, and the post was referenced in the firm’s Form 8-K filing with the SEC. The attacker purportedly accessed the data via an API that allegedly lacked proper web application firewall protection, rate limiting, and authentication.
CenterPoint says it is actively investigating the incident and has activated incident response procedures, engaging external cybersecurity, forensic, and legal advisers. The firm indicated that it is assessing the scope of affected customer data to determine who will receive notifications in accordance with applicable legal requirements. The firm also noted that it has not, at least publicly, issued individual letters to affected customers.
The claims from the hacker, while they have drawn scrutiny, remain part of ongoing investigations; the regulator-listed impact clearly identifies sensitive personal data involved and underscores the need for CentrePoint to evaluate notification obligations and remediation measures for customers affected by the incident. CenterPoint urges continued collaboration with third-party experts to determine the precise scope and affected individuals.