Houston-based utility CenterPoint Energy has told the Texas Attorney General's Office that a data breach affected 1,062,060 Texas residents. According to SecurityWeek, which reported the filing on October 15, the exposed data includes names, addresses, Social Security numbers and driver's license numbers.
The state filing is the first victim count tied to the incident. It came about a month after CenterPoint disclosed the breach in a Form 8-K filed with the U.S. Securities and Exchange Commission on September 14. That filing said an unauthorized party had obtained personal information relating to "a portion of the Company's customers" but did not say how many. SecurityWeek reported that, at the time of its story, notification letters to affected individuals did not appear to have gone out.
The Texas number covers only one of the four states CenterPoint serves. The company has about 7 million customers across Texas, Indiana, Minnesota and Ohio, according to The Record, and SecurityWeek noted that customers in the other states may also be affected. CenterPoint has not published a total, so the full scope of the breach is still unknown.
How the disclosure unfolded
The public record so far comes in three pieces: a claim on a criminal forum, the company's SEC filing, and the Texas regulatory notice.
- September 2026: an online post. CenterPoint's 8-K says the company learned of the incident in September, after a third party posted online claiming to have obtained customer data. SecurityWeek reported that the post appeared on a cybercrime forum days before the company's first disclosure.
- September 12: a sample archive (claimed). SecurityWeek reported that a hacker claimed to hold nearly 7.5 million records and made a 2.5 GB archive available for download on September 12. The archive reportedly contained about 3 million phone numbers. Neither CenterPoint nor any regulator has confirmed these figures.
- September 14: the SEC filing. CenterPoint filed a Form 8-K under Item 8.01 ("Other Events"). It did not use Item 1.05, the item for material cybersecurity incidents. The company said the unauthorized party got the data through an external-facing system and that electric and gas delivery were not affected. It also said it had activated its incident response protocols, started an investigation with outside cybersecurity experts, and reported the matter to law enforcement and certain regulators.
- September 15: the company declines to say more. The Record reported that CenterPoint declined to answer other questions about the post. The company said it was working with third-party experts to determine which customers and data were affected and would notify customers and regulators as required by law.
- October 15: SecurityWeek reports the Texas filing. The filing lists the roughly 1.06 million affected residents and the categories of data exposed.
What is confirmed, and what is only claimed
The confirmed facts come from CenterPoint's own filings. The company has acknowledged that an unauthorized party obtained customer personal information through an external-facing system. It reported 1,062,060 affected Texas residents to the state, and it listed names, addresses, Social Security numbers and driver's license numbers as exposed in that notice.
The larger numbers come only from the actor who posted about the data. The roughly 7.5 million record count, the 2.5 GB archive and the 3 million phone numbers are all the actor's claims. The Record reported that the dark web post said the dataset included customer names, account information, the last four digits of Social Security numbers and billing information. None of that has been verified. The Texas filing lists Social Security numbers among the exposed data, but it does not settle how the actor's description compares with what was actually taken.
The difference matters for anyone trying to size the incident. The actor's 7.5 million figure is a little higher than CenterPoint's roughly 7 million customers. That could mean the dataset includes former customers, duplicate records or records that aren't about customers at all. It could also mean the claim is inflated. Until CenterPoint or another state regulator publishes more numbers, the only verified figure is the Texas count.
CenterPoint has not named the external-facing system involved, said how the attacker got access, or said when the intrusion began. It has not attributed the incident to any group, and this article does not either.
Why the filing item matters
CenterPoint's choice of Item 8.01 over Item 1.05 matches what it told investors. In the 8-K, the company said it does not currently expect the incident to have a material effect on its financial condition or results, and that it believes its cybersecurity insurance will offset the response costs. The Record noted the company's second-quarter net income was $244 million. A breach can expose more than a million people's identity documents and still fall below the materiality threshold for the company's finances. The SEC filing tells investors about financial risk. The state notices are where the impact on customers is recorded.
This is also not the company's first recent incident. The Record reported that last year CenterPoint announced it was investigating a separate breach tied to a 2023 incident in which hackers stole customer information through a file-sharing platform. Nothing published so far connects the two incidents.
What It Means for Defenders
CenterPoint has not published technical indicators, a CVE or details about the affected system. The guidance below is therefore general rather than tied to a specific product.
- Inventory external-facing systems that hold customer data. The 8-K names an external-facing system as the way in. Utilities and other companies with large customer bases should list every internet-reachable application that can query customer records, including billing portals, customer service tools, file transfer services and third-party integrations. For each one, confirm who owns it, what patch level it runs and how its logs are monitored.
- Watch for unusually large data pulls. Alert on large or unusual exports from customer databases, especially through service accounts or API keys that normally move small amounts of data. Discovering a breach from an online post usually means the theft was not caught while it was happening.
- Monitor criminal forums and leak sites. CenterPoint learned of the incident from a third party's post. Searching those channels for your organization's name, domains and data samples can shorten the time between theft and discovery.
- Review vendors and file transfer tools. Given the company's earlier incident involving a file-sharing platform, any organization that has been hit through one external system should check whether other external systems have the same weak points. That includes products that store or relay customer data on its behalf.
- Expect phishing that uses the breach. Help desks and fraud teams at utilities, banks and telecoms should expect calls and messages that use leaked names, addresses and account details to make social engineering or account takeover attempts more convincing. Tighten identity checks so that knowing a Social Security number or account number is not enough to change account details.
- For affected individuals. Texas residents whose Social Security and driver's license numbers were exposed should consider freezing their credit with all three major bureaus. They should also watch for unexpected accounts and be skeptical of calls, texts or emails that claim to come from CenterPoint and ask for payment or verification. Contact details in any breach notice can be checked against the company's published contact information before responding.
What comes next
The main open questions are how many customers outside Texas were affected and when individual notifications will go out. Breach notices in Indiana, Minnesota or Ohio, or an amended SEC filing, would be the most likely places for more numbers to appear. Until then, the roughly 1.06 million Texans is the only victim count CenterPoint has filed with a regulator.
