CenterPoint Energy Data Breach Exposes Personal Information of Over 1 Million Texans

CenterPoint Energy has officially notified Texan authorities of a significant data breach that has compromised the personal information of over 1 million individuals within the state. This disclosure follows a period of investigation and comes approximately one month after the Houston-based public utility first alerted the U.S. Securities and Exchange Commission (SEC) about unauthorized access to its systems.

The incident came to light after a threat actor boasted on a cybercrime forum about obtaining nearly 7.5 million user records from CenterPoint Energy. In its filing with the SEC, the company acknowledged learning of the breach through this public post, assuring that only a subset of its customer base was affected and that the incident did not disrupt its operational capabilities.

More recently, CenterPoint Energy provided an update to the Texas Attorney General's Office, specifying that 1,062,060 Texas residents were impacted by the breach. As of the latest reports, it appears the utility has not yet issued formal notification letters to the affected individuals, leaving them potentially unaware of the exposure of their sensitive data.

The compromised personal information, as detailed in the company's filing, includes full names, residential addresses, Social Security numbers, and driver's license numbers. This type of data is highly sought after by cybercriminals for identity theft, financial fraud, and other malicious activities.

While the notification to Texas authorities focused on state residents, CenterPoint Energy also serves customers in Indiana, Minnesota, and Ohio. The full scope of the breach across all its service areas remains unclear, raising concerns that individuals in other states may also have had their data exposed.

Further details emerged when the threat actor made a 2.5-gigabyte archive available for download on September 12. This file allegedly contained data exfiltrated from CenterPoint Energy's systems and reportedly includes approximately 3 million phone numbers in addition to other personal identifiers. The exact method of access and the full extent of data exfiltration are still under investigation.

This breach adds to a growing list of significant data compromises affecting large organizations and public utilities. The exposure of such sensitive personal information underscores the persistent threats faced by critical infrastructure and the urgent need for robust cybersecurity measures to protect customer data from unauthorized access and exploitation.