CENTERPOINT Energy has told Texan authorities that personal information for more than 1 million people was compromised in a data breach. In a Texas Attorney General filing, the utility said 1,062,060 state residents were affected, and that it has not yet sent notification letters to those individuals. The breach was first disclosed after a threat actor publicised the incident, and CenterPoint stressed that only a portion of its customers were impacted and that its operations were not affected. The data exposed includes names, addresses, Social Security numbers and driver’s licence numbers.
The incident follows a hacker’s claim on a cybercrime forum that they had obtained nearly 7.5 million CentrePoint Energy records. SecurityWeek notes that, prior to the initial disclosure, a 2.5‑gigabyte archive was made available, reportedly containing data exfiltrated from the utility and comprising roughly 3 million phone numbers along with additional personal information.
CentrePoint Energy operates electricity and natural gas services in Texas as well as Indiana, Minnesota and Ohio; it is not clear whether residents in those other states were affected to the same extent. SecurityWeek has sought clarifications from the company and will update the article if CentrePoint responds.