CenterPoint Energy confirms customer data stolen in cyberattack

CenterPoint Energy says an unauthorized third party obtained personal information linked to some customers through an external-facing system. The Houston-based utility disclosed the incident in a filing with the U.S. Securities and Exchange Commission (SEC), while an investigation continues.

A threat actor using the alias “4d722e4d656f77” previously claimed to have stolen 7.49 million customer records. The alleged data included names, phone numbers, service and billing addresses, account numbers, billing amounts, and partial Social Security numbers. CenterPoint has not confirmed the number of affected customers or the types of information involved.

The company serves approximately 7 million metered customers across Indiana, Minnesota, Ohio, and Texas. It employs roughly 8,300 people and reports more than $9.3 billion in annual revenue.

CenterPoint said its electric and gas services were not affected and that it does not believe the incident will materially affect its business or financial condition. The company has activated its incident-response procedures, hired outside cybersecurity experts, strengthened system protections, and reported the incident to law enforcement and regulators.

Multiple proposed class-action lawsuits have been filed in federal courts. The complaints allege that the breach occurred between August 17 and September 1. CenterPoint said it plans to notify affected customers and regulatory authorities as required while experts determine the scope of the incident.