CenterPoint Energy Breach Hits 1,062,060 Texans, Notices Still Pending

What the Texas filing shows

The Texas attorney general's breach database now puts a hard number on CenterPoint Energy's data breach: 1,062,060 state residents. According to SecurityWeek and SecureBlink, the filing lists names, addresses, Social Security numbers and driver's license numbers among the exposed fields. Customers had not yet been notified when the filing was made, Yahoo News reported.

That gap is the real news. For weeks, the company had described the incident only as affecting "a portion" of its customers. The state filing turns that vague phrase into a number anyone can check against a public database.

Texas requires companies to report breach totals to the attorney general, which is how the count became public before any customer letters went out. CW39 and Yahoo News both reported on the filing.

How the disclosure unfolded

CenterPoint told the Securities and Exchange Commission in September that an unauthorized party had obtained customer information through an external-facing system. SecureBlink dates that disclosure to September 14. The company said it learned of the incident from a third party's online post.

The company said it had engaged outside experts and notified law enforcement and regulators. Coverage from KHOU and SecureBlink noted what the filing left out: which system was hit, when the intrusion occurred and how many people were affected.

When KHOU asked CenterPoint about the filing, the company replied in writing with a single line: "Our filing speaks for itself." That statement came from the company, not a named spokesperson. KHOU also reported that electric and gas service was not affected, which points to a data incident rather than an outage.

Which customers may be affected

CenterPoint serves about 7 million customers across Indiana, Minnesota, Ohio and Texas. The Texas filing covers only state residents, so it cannot show how many people outside Texas were involved. Residents of Indiana, Minnesota and Ohio may also be affected, but no filing has confirmed that.

The Texas figure is also not a customer count. The filing counts residents, so the 1,062,060 total and the 7 million customer base cannot be compared directly. The number is still large enough to show the breach reached far beyond a small set of accounts.

Texans whose Social Security or driver's license numbers were in the dataset face the most serious risk. Those identifiers, paired with a name and address, are the kinds of details thieves use to open accounts in someone else's name. That risk is general to this type of data, not a finding from any investigation.

What the hacker claimed and what is unverified

Several figures are circulating, and they come from very different sources. Only the Texas number comes from a state filing.

In early September, a hacker posted a claim on a cybercrime forum to have obtained nearly 7.5 million records. The company has not confirmed that figure. The alleged archive was offered on September 12 as a 2.5 GB file that reportedly contains about 3 million phone numbers and other personal data. That is the attacker's claim, not a verified finding.

Some outlets now use 7.49 million for the forum claim. That extra precision is not backed by anything CenterPoint has released.

Five class actions and the intrusion window

Plaintiffs' firms moved within days. Edelson Lechtzin LLP announced an investigation on September 10, according to a PR Newswire release carried by Morningstar. Five proposed class actions are now pending in federal court. They allege inadequate security, cite FTC guidance and name customers in Texas, Indiana and Minnesota, TEISS reported.

The suits place the intrusion between August 17 and September 1. No class has been certified, so every claim remains an allegation. If that window holds, the intrusion ended about two weeks before CenterPoint's September 14 SEC disclosure. The company has not confirmed either date.

What affected customers should do now

These steps are general consumer guidance, not instructions from CenterPoint or a regulator. They apply to anyone whose Social Security or driver's license number may have been exposed.

• Check your credit reports for accounts or inquiries you do not recognize. You can get free reports at AnnualCreditReport.com.
• Place a free credit freeze with Equifax, Experian and TransUnion. A freeze blocks most new-account checks until you lift it.
• If a freeze feels like too much, set an initial fraud alert with one bureau. That bureau will share it with the other two.
• If you find misuse, file a report at IdentityTheft.gov and a police report where you live.
• Keep any CenterPoint notice letter. It may matter if a settlement follows.
• Treat unsolicited calls, texts or emails claiming to be from CenterPoint that ask for payment or personal details as suspicious. Call the number printed on your bill to check.

How this compares with other recent breaches

Utility breaches are not rare, but this one shows how a state filing can set the timeline. The public learned the most concrete facts from a Texas database and from lawsuits, not from the company itself. CenterPoint holds the forensic details, while customers carry the risk.

A separate case in South Korea is a useful contrast. According to The Korea Times, regulators said AI-driven cyberattacks hit 16 financial firms and exposed about 100,000 records. Regulators said account and card numbers were not found to be compromised. Nothing in the reporting on CenterPoint links its breach to AI tools.

For another example of how a vendor breach can reach many customers at once, see ConnectWise's cloud backup breach, where service was shut off after 173 tenants were affected. A cyberattack on Senture also knocked out the FMCSA trucker phone help line, as USA 24 reported.

What to watch next

• Whether CenterPoint amends its September SEC disclosure to name the system, the intrusion window and the affected count.
• When notification letters go out, and whether the company publishes a total beyond Texas. CenterPoint says it will notify customers as required by law.
• Whether regulators in Indiana, Minnesota or Ohio open inquiries.
• Whether the forum claim holds up, and whether any of the five class actions moves toward certification.

The next concrete signal will be the notice letters. Once customers receive them, the count, the exposed fields and the timeline can be tested against one another. If those details diverge from the Texas filing, the gap will become a story of its own.