CenterPoint Energy breach hits over 1 million Texans
CenterPoint Energy has confirmed that personal information belonging to more than 1 million people in Texas was compromised in a data breach. Names, addresses, Social Security numbers and driver's license numbers were among the exposed data.
The Houston-based public utility reported the figure this week to the Texas Attorney General's Office, the state authority that receives breach notifications when residents' personal data is exposed. According to that filing, 1,062,060 Texans were affected.
The new numbers came about a month after CenterPoint Energy first told the US Securities and Exchange Commission (SEC) that customer information had been stolen from its systems. Publicly traded companies in the US must report material cybersecurity incidents to the SEC.
A hacker's post came first
The company did not discover the breach through its own monitoring. In its SEC filing, CenterPoint Energy said it learned about the incident after a threat actor posted about it publicly.
A few days before the utility's first disclosure, a hacker claimed on a known cybercrime forum to have obtained nearly 7.5 million user records from CenterPoint Energy. In its SEC filing, the company said that only part of its customer base was affected and that the incident had no impact on its operations.
On September 12, the hacker published a 2.5-gigabyte archive for download that allegedly contains data taken from the utility. The file appears to hold roughly 3 million phone numbers, along with other personal information.
What was exposed
The filing with the Texas Attorney General lists the following data types:
- names
- addresses
- Social Security numbers
- driver's license numbers
Social Security numbers and driver's license numbers together are valuable to fraudsters. They can be used to open accounts, apply for credit or get past identity checks in another person's name.
It appears that CenterPoint Energy has not yet sent notification letters to the affected individuals.
The full scope is still unclear
The Texas figure may not be the final count. CenterPoint Energy also supplies electricity and natural gas to customers in Indiana, Minnesota and Ohio, and people in those states may have been affected too.
So far, the total number of victims has not been made public. There is also a large gap between the hacker's claim of nearly 7.5 million records, the roughly 3 million phone numbers in the leaked archive, and the just over 1 million Texans reported to state authorities. SecurityWeek, which first reported on the Texas filing, said it had asked the company for clarification on the overall number of people affected.
CenterPoint Energy is not the only US utility to report a large breach recently. Earlier this month, a breach at Georgia Power and Alabama Power, both owned by Southern Company, exposed 400,000 utility accounts.
Our Take
The most uncomfortable detail here is how CenterPoint Energy found out. A utility serving customers in several states learned that its data had been taken from a post on a cybercrime forum, not from its own detection tools. That pattern is becoming familiar, and it suggests that data theft can go unnoticed for some time, even at organisations that run critical services.
The incident also shows that a breach does not need to disrupt operations to cause serious harm. The lights stayed on, but over a million people now have their Social Security and driver's license numbers in criminal hands. Combined with the leaked phone numbers, that data could fuel targeted phishing and identity fraud. This fits a wider trend of large breaches hitting sectors that hold sensitive personal data, such as the healthcare incidents at iRhythm and Oracle Health.
It is worth watching whether CenterPoint Energy files similar notices in Indiana, Minnesota and Ohio, and whether the final total moves closer to the hacker's claim. The timing of notification letters to victims also matters. Until those letters arrive, affected customers may not know they should freeze their credit or watch for suspicious messages.