CenterPoint Energy Confirms Customer Data Stolen in Cyberattack

Houston-based utility CenterPoint Energy has confirmed that an unauthorized third party got hold of personal information belonging to some of its customers. The company made the disclosure in a Form 8-K filing with the U.S. Securities and Exchange Commission on September 14, 2026. Electric and natural gas delivery continue without interruption. The company does not expect the incident to hit its financial condition in any material way.

CenterPoint serves roughly seven million metered customers across Texas, Indiana, Minnesota, and Ohio. It employs thousands of people and manages tens of billions in assets. For many households the company is simply the entity that keeps the lights on and the stove working. That everyday reliance makes any breach of customer records feel personal and unsettling.

The story surfaced when a third party posted online claiming to possess a large data set tied to CenterPoint accounts. The company noticed the post in early September, activated its incident-response protocols, and brought in outside cybersecurity specialists. Investigators later determined that personal information relating to a portion of customers had been obtained through one of the company’s external-facing systems. CenterPoint has not publicly named the exact system or confirmed how many people are affected. It has also not listed every data field involved. The investigation continues.

A threat actor posting under the alias 4d722e4d656f77 claimed to have extracted about 7.49 million records. According to reports citing the forum posts, the alleged data included customer names, phone numbers, service and billing addresses, account numbers, billing amounts, due dates, email addresses, and the last four digits of Social Security numbers. Some posts also mentioned driver’s license numbers and other account details. CenterPoint has not verified those numbers or the full list of fields. The company stated only that personal information of a portion of its customers was obtained. That careful wording is important. Claims made on underground forums often exaggerate. Independent confirmation is still underway.

The company reported the matter to law enforcement and intends to notify affected customers and the relevant regulators once the scope is clearer. It has already taken steps to further harden the systems that were involved. Cybersecurity insurance is expected to offset a meaningful share of the response costs. Operations remain steady. No disruption to power or gas service has occurred.

Class-action lawsuits began appearing in federal courts even before the formal SEC filing. Law firms representing customers in Texas, Indiana, and Minnesota filed proposed class actions alleging exposure of names, contact details, billing information, and Social Security numbers. Those cases are still in early stages. No class has been certified. The lawsuits illustrate how quickly legal action can follow public claims of a breach, even while the company is still mapping the full extent of what happened.

For customers the practical question is straightforward: what should I do right now? First, watch for official communication from CenterPoint. The company has said it will notify people as required by law once it finishes determining who was affected and what information was involved. Do not rely solely on social media posts or third-party alerts that lack verification. Official notices typically arrive by mail or through the channels the utility already uses for account communication.

In the meantime, treat the possibility of exposure seriously. Place a free fraud alert with one of the three major credit bureaus. That alert requires businesses to take extra steps before opening new credit in your name. You can also freeze your credit reports. A freeze stops most new accounts from being opened until you lift it. Both steps are free and can be done online or by phone. Review your recent bank and credit card statements for unfamiliar charges. Set up transaction alerts if you have not already. Consider monitoring services that watch for misuse of your personal details, though free options from the credit bureaus themselves are a solid starting point.

Be especially careful with any unexpected contact that claims to be from CenterPoint or from a “breach response team.” Scammers often exploit real incidents. They call or email, mention the breach, and ask for account numbers, passwords, or payment to “secure” your information. CenterPoint will not demand immediate payment or request your full Social Security number over the phone in response to this event. If something feels off, hang up and contact the company through the phone number or website you already know and trust.

Utilities sit in a difficult position. They hold large volumes of customer data because billing, service activation, and regulatory requirements demand it. At the same time, the systems that manage that data must remain accessible enough for customers and employees to use every day. External-facing interfaces, including application programming interfaces that exchange information with other systems, can become weak points when they lack strong authentication, rate limiting, or continuous monitoring. Industry observers have noted that critical infrastructure operators face rising pressure to treat customer data systems with the same seriousness they apply to operational technology that keeps the grid running. This incident underscores that the two worlds are linked even when the power stays on.

CenterPoint’s filing emphasizes that its core delivery of electricity and natural gas was never compromised. That distinction matters. A data breach of customer records is serious for the individuals whose information was taken. It does not automatically mean the physical infrastructure that generates or distributes energy was breached. Still, the episode adds to a longer pattern of cyber incidents targeting companies that sit at the intersection of essential services and large consumer databases.

Customers who receive a formal notice should read it carefully. It should explain what categories of information were involved for that specific person and what support the company is offering. Many organizations provide free credit monitoring for a set period after a confirmed breach. Keep the notice. It may be useful if you later need to prove the timing of the incident for any identity-theft report.

Lawmakers and regulators will almost certainly examine the case. Utilities operate under a mix of state and federal rules. Data-protection expectations have tightened in recent years, and disclosure requirements through the SEC already force publicly traded companies to report material cybersecurity incidents quickly. CenterPoint’s decision to file the 8-K reflects that obligation. Whether additional state-level investigations or enforcement actions follow remains to be seen.

For now the most useful posture for individual customers is measured caution rather than panic. Confirm that any communication claiming to be official actually comes from CenterPoint through known channels. Strengthen the usual defenses around credit and banking. Stay alert for phishing attempts that reference the breach. And wait for the company’s formal notification process to identify who is directly affected.

The investigation is ongoing. CenterPoint continues to work with outside experts to map the full scope. Until that work finishes, precise numbers and complete lists of compromised fields stay out of public view. What is clear is that personal information belonging to some customers left the company’s systems without authorization. That fact alone is enough reason for affected households to take the practical steps available to them.

Utilities like CenterPoint sit at the center of daily life for millions of people. When their customer data systems are breached, the consequences reach beyond corporate balance sheets. They reach into the ordinary accounts people use to pay bills and keep their homes running. Clear communication, careful verification of any claims, and prompt personal protective actions remain the best response while the full picture continues to emerge.