Over one million Texans now appear in an official count of the CenterPoint Energy data breach. The Texas attorney general's breach database lists 1,062,060 Texans as affected, according to a Click2Houston report published October 14. Most outlets rounded that figure to “more than 1 million,” but the database number is the one regulators will track.
What the Texas attorney general’s filing shows
Texas breach-notice rules require businesses to report breaches affecting at least 250 Texans to the attorney general within 30 days of discovery. Businesses must also notify consumers no later than 60 days after they determine a breach occurred, according to Click2Houston’s reporting. Those deadlines help explain why an official count surfaced weeks after CenterPoint first disclosed the incident in September.
The data involved is sensitive. The filing lists names, addresses, Social Security numbers and driver’s license numbers. That combination is what identity thieves use to open accounts in someone else’s name, so the exposure carries real risk even though the utility’s power and gas service kept running.
The company has said little about the scope. In a statement reported by ABC13, CenterPoint said, “CenterPoint’s delivery of electric and gas services has not been impacted and remains operational and undisrupted.” In a separate statement, the company said it “continues to actively investigate the cybersecurity incident disclosed last month.”
How the breach came to light
The sequence started on a criminal forum, not in a company announcement. CenterPoint is a Houston-based electric and natural gas utility whose shares trade on the New York Stock Exchange under the ticker CNP, according to CyberInsider. A forum user with the handle “4d722e4d656f77” claimed to have pulled roughly 7.49 million customer records. CenterPoint has not confirmed that figure or the authenticity of the published dataset.
A rival account put the claim at about 6.7 million records, totaling 48.8 GiB, with a claimed pull date of August 21, 2026, as TechNadu reported. The public timeline looks like this:
| Date | Event |
|---|---|
| August 21, 2026 | Claimed pull date for the dataset, according to a rival account |
| Days before September 14 | Hacker boasts on a cybercrime forum of obtaining nearly 7.5 million records |
| September 14, 2026 | CenterPoint files a Form 8-K with the SEC after becoming aware of an online post |
| October 14, 2026 | Texas attorney general’s database lists 1,062,060 Texans as affected |
In its SEC filing, CenterPoint said an unauthorized third party “obtained personal information relating to a portion of the Company’s customers through one of the Company’s external-facing systems.” The company did not say which system was involved or how it was breached. Help Net Security covered the disclosure two days after the filing.
The hacker offered a more specific account. According to the claim, the data was gathered by enumerating customer account numbers through a guest-facing API that was not properly locked down. Nothing in the public record confirms that method. It does match a familiar failure pattern, in which an application lets anyone cycle through sequential identifiers and receive back other people’s records.
Internet-facing systems have been a repeated target. USA 24 has covered similar exposure, including an Ivanti Connect Secure zero-day that was exploited for 12 days before a patch was available.
Which data was exposed, and where the reporting disagrees
The hacker’s claimed dataset includes more fields than CenterPoint has disclosed. According to Help Net Security, the listed fields include customer names, phone numbers, service and billing addresses, account numbers, premise IDs, billing amounts, due dates, autopay and paperless billing status, rate class, email addresses, driver’s license numbers, and the last four digits of Social Security numbers. The company has not confirmed that list.
That field set reads like a utility billing database, and it explains why this is more than a names-and-addresses leak. Billing amounts, due dates and autopay status give a scammer a convincing script. A caller who knows your account number and your typical bill can sound legitimate.
The Social Security question remains open. The hacker claimed only the last four digits. The Texas filing lists “Social Security numbers” without qualification, as Click2Houston reported. Until CenterPoint or the attorney general clarifies the scope, people should plan for the broader reading.
Is my CenterPoint Energy account affected
This is the question most readers will ask, and the public record cannot answer it for individuals yet. CenterPoint serves about 7 million customers across Indiana, Minnesota, Ohio and Texas, according to Security Affairs. The Texas filing covers Texans only. SecurityWeek reported that residents of Indiana, Minnesota and Ohio might also be affected, but no source confirms that.
Customers generally cannot avoid this exposure. Yahoo News, citing BleepingComputer, noted that utility users typically do not have the option of withholding personal and billing information from their provider. That makes the notification process more important than usual.
Until a letter arrives, you cannot confirm your status from public sources. If a notice arrives, verify it independently by calling the number printed on your bill or visiting the company’s official website. Do not use links or phone numbers included in the message itself.
What to do now if you may be affected
Start with the free protections. These are general steps, not instructions from the company:
- Place a free credit freeze with Equifax, Experian and TransUnion. A freeze blocks most new credit applications in your name until you lift it.
- Enable an IRS Identity Protection PIN. This six-digit code prevents someone else from filing a tax return using your Social Security number.
- Check your credit reports at AnnualCreditReport.com, the official free source.
- Review bank and credit-card statements for charges you do not recognize.
- Treat unsolicited calls, texts or emails about your utility bill as suspicious. Hang up and call the number printed on your bill.
- Change the password on your utility account and on any other account where you reused the same password.
If you receive an official letter, follow its instructions for any offered monitoring service and keep a copy for your records. Deadlines in these letters matter, so note them when they arrive.
What comes next for CenterPoint and affected customers
The scale of this breach is comparable to other recent cases, but the method appears different. NBC4 Columbus reported that Central Ohio Primary Care Physicians said 1.4 million people were impacted, and that its breach was linked to vishing and a ransomware group. CenterPoint’s alleged entry point is a web-facing system, a claim the company has not confirmed.
Several questions will shape how this story develops:
- Whether the 1,062,060 Texas figure rises as notifications go out. The total impact remains unclear.
- Whether residents of Indiana, Minnesota and Ohio are affected.
- Whether the leaked dataset is authentic and how many records it actually contains.
- Whether Social Security numbers were fully exposed or only the last four digits.
- How the external system was compromised and how long it was exposed.
- Whether a class action or regulatory action follows. No source in this research confirms a lawsuit or penalty.
The next concrete milestone is the notification letters. Texas’s 60-day deadline, measured from when the company determined a breach occurred, will shape when they arrive. Until then, the most useful signal will come from the attorney general’s database, which can be updated, and from any further SEC filings. Texans who are still waiting to learn whether their names are in the file should assume they may be affected and act on the protections above.
