# CenterPoint Breach Exposes Personal Data of Over 1 Million Texans

- URL: https://usa-24.com/centerpoint-energy-data-breach-texans/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-16T08:48:16.747Z
- Updated: 2026-10-16T11:55:06.096Z
- Topics: CenterPoint Energy, Data Breach, Texas, Utilities, Identity Theft

> A state attorney general filing lists 1,062,060 Texans in CenterPoint Energy's breach, which exposed names, addresses, Social Security and driver's license numbers. Notification letters have not gone out yet.

## Key takeaways

- The Texas attorney general's breach database lists 1,062,060 Texans as affected, in a filing published October 14, 2026.
- The exposed information includes names, addresses, Social Security numbers and driver's license numbers, according to the state filing.
- CenterPoint disclosed the incident in an SEC Form 8-K filed September 14, 2026, after a hacker claimed about 7.49 million records, a figure the company has not confirmed.
- CenterPoint says its delivery of electric and gas services has not been impacted and remains operational.
- Notification letters do not appear to have gone out yet, and it remains unclear whether Social Security numbers were fully exposed.

Over one million Texans now appear in an official count of the CenterPoint Energy data breach. The Texas attorney general's breach database lists 1,062,060 Texans as affected, according to a [Click2Houston report](https://www.click2houston.com/news/local/2026/10/14/more-than-1-million-texans-affected-by-centerpoint-data-breach-ag-report-shows/) published October 14. Most outlets rounded that figure to “more than 1 million,” but the database number is the one regulators will track.

## What the Texas attorney general’s filing shows

Texas breach-notice rules require businesses to report breaches affecting at least 250 Texans to the attorney general within 30 days of discovery. Businesses must also notify consumers no later than 60 days after they determine a breach occurred, according to Click2Houston’s reporting. Those deadlines help explain why an official count surfaced weeks after CenterPoint first disclosed the incident in September.

The data involved is sensitive. The filing lists names, addresses, Social Security numbers and driver’s license numbers. That combination is what identity thieves use to open accounts in someone else’s name, so the exposure carries real risk even though the utility’s power and gas service kept running.

The company has said little about the scope. In a statement reported by [ABC13](https://abc13.com/post/more-1-million-customers-impacted-centerpoint-energy-data-breach-ag-report-filing-shows/19938921/), CenterPoint said, “CenterPoint’s delivery of electric and gas services has not been impacted and remains operational and undisrupted.” In a separate statement, the company said it “continues to actively investigate the cybersecurity incident disclosed last month.”

## How the breach came to light

The sequence started on a criminal forum, not in a company announcement. CenterPoint is a Houston-based electric and natural gas utility whose shares trade on the New York Stock Exchange under the ticker CNP, according to [CyberInsider](https://cyberinsider.com/centerpoint-energy-confirms-data-breach-after-hacker-claims-7-49m-records/). A forum user with the handle “4d722e4d656f77” claimed to have pulled roughly 7.49 million customer records. CenterPoint has not confirmed that figure or the authenticity of the published dataset.

A rival account put the claim at about 6.7 million records, totaling 48.8 GiB, with a claimed pull date of August 21, 2026, as [TechNadu](https://www.technadu.com/centerpoint-energy-confirms-data-breach-after-hacker-claims-6-7-million-customer-records-stolen/637265/) reported. The public timeline looks like this:

| Date | Event |
|---|---|
| August 21, 2026 | Claimed pull date for the dataset, according to a rival account |
| Days before September 14 | Hacker boasts on a cybercrime forum of obtaining nearly 7.5 million records |
| September 14, 2026 | CenterPoint files a Form 8-K with the SEC after becoming aware of an online post |
| October 14, 2026 | Texas attorney general’s database lists 1,062,060 Texans as affected |

In its SEC filing, CenterPoint said an unauthorized third party “obtained personal information relating to a portion of the Company’s customers through one of the Company’s external-facing systems.” The company did not say which system was involved or how it was breached. [Help Net Security](https://www.helpnetsecurity.com/2026/09/16/centerpoint-energy-data-breach-hacker-claims/) covered the disclosure two days after the filing.

The hacker offered a more specific account. According to the claim, the data was gathered by enumerating customer account numbers through a guest-facing API that was not properly locked down. Nothing in the public record confirms that method. It does match a familiar failure pattern, in which an application lets anyone cycle through sequential identifiers and receive back other people’s records.

Internet-facing systems have been a repeated target. USA 24 has covered similar exposure, including an [Ivanti Connect Secure zero-day that was exploited for 12 days before a patch](https://usa-24.com/ivanti-connect-secure-zero-day-patch/) was available.

## Which data was exposed, and where the reporting disagrees

The hacker’s claimed dataset includes more fields than CenterPoint has disclosed. According to [Help Net Security](https://www.helpnetsecurity.com/2026/09/16/centerpoint-energy-data-breach-hacker-claims/), the listed fields include customer names, phone numbers, service and billing addresses, account numbers, premise IDs, billing amounts, due dates, autopay and paperless billing status, rate class, email addresses, driver’s license numbers, and the last four digits of Social Security numbers. The company has not confirmed that list.

That field set reads like a utility billing database, and it explains why this is more than a names-and-addresses leak. Billing amounts, due dates and autopay status give a scammer a convincing script. A caller who knows your account number and your typical bill can sound legitimate.

The Social Security question remains open. The hacker claimed only the last four digits. The Texas filing lists “Social Security numbers” without qualification, as [Click2Houston](https://www.click2houston.com/news/local/2026/10/14/more-than-1-million-texans-affected-by-centerpoint-data-breach-ag-report-shows/) reported. Until CenterPoint or the attorney general clarifies the scope, people should plan for the broader reading.

## Is my CenterPoint Energy account affected

This is the question most readers will ask, and the public record cannot answer it for individuals yet. CenterPoint serves about 7 million customers across Indiana, Minnesota, Ohio and Texas, according to [Security Affairs](https://securityaffairs.com/199170/data-breach/texas-utility-centerpoint-energy-confirms-data-breach-after-hacker-claims-7-49m-records-stolen.html). The Texas filing covers Texans only. [SecurityWeek](https://www.securityweek.com/centerpoint-energy-data-breach-impacts-1-million-texans/) reported that residents of Indiana, Minnesota and Ohio might also be affected, but no source confirms that.

Customers generally cannot avoid this exposure. [Yahoo News, citing BleepingComputer](https://www.yahoo.com/news/us/articles/centerpoint-confirms-customer-data-breach-003900265.html), noted that utility users typically do not have the option of withholding personal and billing information from their provider. That makes the notification process more important than usual.

Until a letter arrives, you cannot confirm your status from public sources. If a notice arrives, verify it independently by calling the number printed on your bill or visiting the company’s official website. Do not use links or phone numbers included in the message itself.

## What to do now if you may be affected

Start with the free protections. These are general steps, not instructions from the company:

- Place a free credit freeze with Equifax, Experian and TransUnion. A freeze blocks most new credit applications in your name until you lift it.
- Enable an IRS Identity Protection PIN. This six-digit code prevents someone else from filing a tax return using your Social Security number.
- Check your credit reports at AnnualCreditReport.com, the official free source.
- Review bank and credit-card statements for charges you do not recognize.
- Treat unsolicited calls, texts or emails about your utility bill as suspicious. Hang up and call the number printed on your bill.
- Change the password on your utility account and on any other account where you reused the same password.

If you receive an official letter, follow its instructions for any offered monitoring service and keep a copy for your records. Deadlines in these letters matter, so note them when they arrive.

## What comes next for CenterPoint and affected customers

The scale of this breach is comparable to other recent cases, but the method appears different. [NBC4 Columbus](https://www.nbc4i.com/news/local-news/central-ohio-news/1-4-million-impacted-by-central-ohio-primary-care-physicians-data-breach/) reported that Central Ohio Primary Care Physicians said 1.4 million people were impacted, and that its breach was linked to vishing and a ransomware group. CenterPoint’s alleged entry point is a web-facing system, a claim the company has not confirmed.

Several questions will shape how this story develops:

- Whether the 1,062,060 Texas figure rises as notifications go out. The total impact remains unclear.
- Whether residents of Indiana, Minnesota and Ohio are affected.
- Whether the leaked dataset is authentic and how many records it actually contains.
- Whether Social Security numbers were fully exposed or only the last four digits.
- How the external system was compromised and how long it was exposed.
- Whether a class action or regulatory action follows. No source in this research confirms a lawsuit or penalty.

The next concrete milestone is the notification letters. Texas’s 60-day deadline, measured from when the company determined a breach occurred, will shape when they arrive. Until then, the most useful signal will come from the attorney general’s database, which can be updated, and from any further SEC filings. Texans who are still waiting to learn whether their names are in the file should assume they may be affected and act on the protections above.

## Frequently asked questions

### How many people were affected by the CenterPoint Energy data breach?

The Texas attorney general’s breach database lists 1,062,060 Texans as affected, according to a filing published October 14, 2026. Most reports round that figure to more than 1 million. The count is the first official tally, and it could rise as the company’s investigation continues.

### Was my Social Security number exposed in the CenterPoint breach?

The Texas filing lists Social Security numbers without qualification, but the hacker claimed to hold only the last four digits. Neither CenterPoint nor the attorney general has clarified the scope. Freeze your credit and consider an IRS Identity Protection PIN while the question is open.

### Does the CenterPoint breach affect customers outside Texas?

CenterPoint serves about 7 million customers across Indiana, Minnesota, Ohio and Texas. SecurityWeek reported that residents of those other states might also be affected, but no source confirms it. Watch for official notices and verify any letter before acting on it.

### Did the CenterPoint breach shut off power or natural gas service?

No. The company said its delivery of electric and gas services has not been impacted and remains operational and undisrupted. The incident involves customer data rather than utility operations, according to the company’s statements.

## Sources

1. [More than 1 million Texans affected by CenterPoint data breach, AG report shows](https://www.click2houston.com/news/local/2026/10/14/more-than-1-million-texans-affected-by-centerpoint-data-breach-ag-report-shows/)
2. [CenterPoint Energy Data Breach Impacts 1 Million Texans](https://www.securityweek.com/centerpoint-energy-data-breach-impacts-1-million-texans/)
3. [More than 1 million customers impacted by CenterPoint Energy data breach, AG report filing shows](https://abc13.com/post/more-1-million-customers-impacted-centerpoint-energy-data-breach-ag-report-filing-shows/19938921/)
4. [CenterPoint Energy confirms data breach following claims on hacking forum](https://www.helpnetsecurity.com/2026/09/16/centerpoint-energy-data-breach-hacker-claims/)
5. [Texas Utility CenterPoint Energy Confirms Data Breach After Hacker Claims 7.49M Records Stolen](https://securityaffairs.com/199170/data-breach/texas-utility-centerpoint-energy-confirms-data-breach-after-hacker-claims-7-49m-records-stolen.html)
6. [CenterPoint Energy confirms data breach after hacker claims 7.49M records](https://cyberinsider.com/centerpoint-energy-confirms-data-breach-after-hacker-claims-7-49m-records/)
7. [CenterPoint Energy Confirms Data Breach in SEC 8-K Filing](https://www.technadu.com/centerpoint-energy-confirms-data-breach-after-hacker-claims-6-7-million-customer-records-stolen/637265/)
8. [CenterPoint confirms customer data breach after hacker leaks alleged 7.49 million records](https://www.yahoo.com/news/us/articles/centerpoint-confirms-customer-data-breach-003900265.html)
9. [1.4 million impacted by Central Ohio Primary Care Physicians data breach](https://www.nbc4i.com/news/local-news/central-ohio-news/1-4-million-impacted-by-central-ohio-primary-care-physicians-data-breach/)