# CenterPoint Energy Breach Hits 1,062,060 Texans, Notices Still Pending

- URL: https://usa-24.com/centerpoint-energy-data-breach-texas/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-19T02:26:18.653Z
- Updated: 2026-10-19T02:26:18.660Z
- Topics: Data Breach, CenterPoint Energy, Identity Theft, Class Action, Utilities, Texas

> A new Texas attorney general filing puts CenterPoint Energy's breach at 1,062,060 state residents, and customers had not yet been notified when it was filed.

## Key takeaways

- The Texas attorney general's breach database lists 1,062,060 Texas residents affected by CenterPoint Energy's breach, with Social Security and driver's license numbers among the exposed fields.
- Customers had not yet been notified when the Texas filing was made, and the company had earlier described the incident only as affecting "a portion" of its customers.
- A hacker's claim of nearly 7.5 million records and a 2.5 GB archive remain unverified, and CenterPoint has not confirmed either.
- Five proposed class actions allege an intrusion between August 17 and September 1, and no class has been certified.
- Affected customers should consider a free credit freeze at Equifax, Experian and TransUnion and keep any CenterPoint notice letter.

## What the Texas filing shows

The Texas attorney general's breach database now puts a hard number on CenterPoint Energy's data breach: 1,062,060 state residents. According to [SecurityWeek](https://www.securityweek.com/centerpoint-energy-data-breach-impacts-1-million-texans/) and [SecureBlink](https://www.secureblink.com/threat-feeds/center-point-energy-data-breach-hits-1-06-m-texans-ss-ns-exposed), the filing lists names, addresses, Social Security numbers and driver's license numbers among the exposed fields. Customers had not yet been notified when the filing was made, [Yahoo News reported](https://www.yahoo.com/news/articles/centerpoint-energy-data-breach-affects-132217937.html).

That gap is the real news. For weeks, the company had described the incident only as affecting "a portion" of its customers. The state filing turns that vague phrase into a number anyone can check against a public database.

Texas requires companies to report breach totals to the attorney general, which is how the count became public before any customer letters went out. [CW39](https://cw39.com/news/local/centerpoint-energy-data-breach/) and Yahoo News both reported on the filing.

## How the disclosure unfolded

CenterPoint told the Securities and Exchange Commission in September that an unauthorized party had obtained customer information through an external-facing system. SecureBlink dates that disclosure to September 14. The company said it learned of the incident from a third party's online post.

The company said it had engaged outside experts and notified law enforcement and regulators. Coverage from [KHOU](https://www.khou.com/article/news/local/centerpoint-energy-data-breach/285-b83879b3-cce8-4288-b9fe-3e10d8c2604c) and SecureBlink noted what the filing left out: which system was hit, when the intrusion occurred and how many people were affected.

When KHOU asked CenterPoint about the filing, the company replied in writing with a single line: "Our filing speaks for itself." That statement came from the company, not a named spokesperson. KHOU also reported that electric and gas service was not affected, which points to a data incident rather than an outage.

## Which customers may be affected

CenterPoint serves about 7 million customers across Indiana, Minnesota, Ohio and Texas. The Texas filing covers only state residents, so it cannot show how many people outside Texas were involved. Residents of Indiana, Minnesota and Ohio may also be affected, but no filing has confirmed that.

The Texas figure is also not a customer count. The filing counts residents, so the 1,062,060 total and the 7 million customer base cannot be compared directly. The number is still large enough to show the breach reached far beyond a small set of accounts.

Texans whose Social Security or driver's license numbers were in the dataset face the most serious risk. Those identifiers, paired with a name and address, are the kinds of details thieves use to open accounts in someone else's name. That risk is general to this type of data, not a finding from any investigation.

## What the hacker claimed and what is unverified

Several figures are circulating, and they come from very different sources. Only the Texas number comes from a state filing.

| Figure | Where it comes from | Status |
|---|---|---|
| 1,062,060 Texas residents | Texas attorney general filing | Filed by CenterPoint with the state |
| Nearly 7.5 million records | Claim posted on a cybercrime forum | Unverified; company has not confirmed |
| 2.5 GB archive, about 3 million phone numbers | Alleged archive offered September 12 | Attacker's claim |
| 7 million filtered records; about 6.7 million customers | Lawsuit allegations | Unverified; no class certified |

In early September, a hacker posted a claim on a cybercrime forum to have obtained nearly 7.5 million records. The company has not confirmed that figure. The alleged archive was offered on September 12 as a 2.5 GB file that reportedly contains about 3 million phone numbers and other personal data. That is the attacker's claim, not a verified finding.

Some outlets now use 7.49 million for the forum claim. That extra precision is not backed by anything CenterPoint has released.

## Five class actions and the intrusion window

Plaintiffs' firms moved within days. Edelson Lechtzin LLP announced an investigation on September 10, according to a [PR Newswire release carried by Morningstar](https://www.morningstar.com/news/pr-newswire/20260910ph45713/centerpoint-energy-data-breach-edelson-lechtzin-llp-launches-investigation-into-exposure-of-personal-information). Five proposed class actions are now pending in federal court. They allege inadequate security, cite FTC guidance and name customers in Texas, Indiana and Minnesota, [TEISS reported](https://www.teiss.co.uk/news/centerpoint-energy-faces-class-actions-over-alleged-customer-data-breach-18157).

The suits place the intrusion between August 17 and September 1. No class has been certified, so every claim remains an allegation. If that window holds, the intrusion ended about two weeks before CenterPoint's September 14 SEC disclosure. The company has not confirmed either date.

## What affected customers should do now

These steps are general consumer guidance, not instructions from CenterPoint or a regulator. They apply to anyone whose Social Security or driver's license number may have been exposed.

- Check your credit reports for accounts or inquiries you do not recognize. You can get free reports at AnnualCreditReport.com.
- Place a free credit freeze with Equifax, Experian and TransUnion. A freeze blocks most new-account checks until you lift it.
- If a freeze feels like too much, set an initial fraud alert with one bureau. That bureau will share it with the other two.
- If you find misuse, file a report at IdentityTheft.gov and a police report where you live.
- Keep any CenterPoint notice letter. It may matter if a settlement follows.
- Treat unsolicited calls, texts or emails claiming to be from CenterPoint that ask for payment or personal details as suspicious. Call the number printed on your bill to check.

## How this compares with other recent breaches

Utility breaches are not rare, but this one shows how a state filing can set the timeline. The public learned the most concrete facts from a Texas database and from lawsuits, not from the company itself. CenterPoint holds the forensic details, while customers carry the risk.

A separate case in South Korea is a useful contrast. According to [The Korea Times](https://www.koreatimes.co.kr/business/banking-finance/20261014/ai-driven-cyberattacks-hit-16-financial-firms-expose-100000-records), regulators said AI-driven cyberattacks hit 16 financial firms and exposed about 100,000 records. Regulators said account and card numbers were not found to be compromised. Nothing in the reporting on CenterPoint links its breach to AI tools.

For another example of how a vendor breach can reach many customers at once, see [ConnectWise's cloud backup breach](https://usa-24.com/connectwise-cloud-backup-breach-2/), where service was shut off after 173 tenants were affected. A cyberattack on Senture also knocked out the FMCSA trucker phone help line, [as USA 24 reported](https://usa-24.com/fmcsa-contact-center-down-senture-cyberattack/).

## What to watch next

- Whether CenterPoint amends its September SEC disclosure to name the system, the intrusion window and the affected count.
- When notification letters go out, and whether the company publishes a total beyond Texas. CenterPoint says it will notify customers as required by law.
- Whether regulators in Indiana, Minnesota or Ohio open inquiries.
- Whether the forum claim holds up, and whether any of the five class actions moves toward certification.

The next concrete signal will be the notice letters. Once customers receive them, the count, the exposed fields and the timeline can be tested against one another. If those details diverge from the Texas filing, the gap will become a story of its own.

## Frequently asked questions

### Is my information in the CenterPoint Energy data breach?

The Texas filing lists the categories of data exposed, not the people affected, so it cannot tell you whether your record is included. CenterPoint says it will notify customers as required by law, and that letter is the most direct confirmation. Until then, check your credit reports for accounts you do not recognize.

### How many people were affected by the CenterPoint breach?

The Texas attorney general's filing lists 1,062,060 Texas residents. Counts for Indiana, Minnesota and Ohio have not been confirmed. A hacker claimed nearly 7.5 million records, but CenterPoint has not confirmed that number, and the lawsuits cite different figures.

### Is there a CenterPoint Energy class action lawsuit?

Yes. Five proposed class actions have been filed in federal court, alleging inadequate security and citing FTC guidance. No class has been certified, so no settlement or payout exists yet. Keep any notice letter you receive in case a settlement follows.

### Should I freeze my credit after the CenterPoint breach?

A credit freeze is free at Equifax, Experian and TransUnion, and it blocks most new-account checks until you lift it. If you prefer a lighter step, an initial fraud alert placed with one bureau is shared with the other two. Check your reports for unfamiliar activity either way.

### Did the CenterPoint breach affect electric or gas service?

CenterPoint says electric and gas service was not affected. The company's September SEC disclosure described an unauthorized party obtaining customer information through an external-facing system. The reported problem is with customer data, not service delivery.

## Sources

1. [CenterPoint Energy data breach affects over 1M Texans, new attorney general report shows (Yahoo News)](https://www.yahoo.com/news/articles/centerpoint-energy-data-breach-affects-132217937.html)
2. [CenterPoint Energy Data Breach Impacts 1 Million Texans — SecurityWeek](https://www.securityweek.com/centerpoint-energy-data-breach-impacts-1-million-texans/)
3. [CenterPoint Energy Data Breach Hits 1.06M Texans, SSNs Exposed — SecureBlink](https://www.secureblink.com/threat-feeds/center-point-energy-data-breach-hits-1-06-m-texans-ss-ns-exposed)
4. [CenterPoint confirms customer information exposed in data breach — KHOU](https://www.khou.com/article/news/local/centerpoint-energy-data-breach/285-b83879b3-cce8-4288-b9fe-3e10d8c2604c)
5. [CenterPoint Energy faces class actions over alleged customer data breach — TEISS](https://www.teiss.co.uk/news/centerpoint-energy-faces-class-actions-over-alleged-customer-data-breach-18157)
6. [CenterPoint Energy Data Breach: Edelson Lechtzin LLP Launches Investigation — PR Newswire via Morningstar](https://www.morningstar.com/news/pr-newswire/20260910ph45713/centerpoint-energy-data-breach-edelson-lechtzin-llp-launches-investigation-into-exposure-of-personal-information)
7. [Over one million Texans impacted by CenterPoint Energy data breach — CW39](https://cw39.com/news/local/centerpoint-energy-data-breach/)
8. [AI-driven cyberattacks hit 16 financial firms, expose 100,000 records — The Korea Times](https://www.koreatimes.co.kr/business/banking-finance/20261014/ai-driven-cyberattacks-hit-16-financial-firms-expose-100000-records)
9. [Financial Sector Suffers Hacking Breaches: Around 100,000 Cases Leaked Across 16 Institutions — SBS News](https://news.sbs.co.kr/english/article.do?news_id=N1008798050)