CenterPoint Energy confirms data theft as hackers claim 7.5 million files

CenterPoint Energy has confirmed that an unauthorized third party obtained personal information from part of its customer base, days after a threat actor advertised stolen data on an underground forum.

The company disclosed the incident in an 8-K filing with the US Securities and Exchange Commission on September 14. It said a third party claimed to have obtained customer information and that the company began an investigation with third-party cybersecurity experts.

The threat actor claimed to have stolen 7.49 million files through a poorly secured API, according to The Register. The alleged data included customer names and contact details, billing information, move-in dates, driver’s license information, and the last four digits of Social Security numbers. Independent investigators have not confirmed those claims.

CenterPoint Energy said the incident did not affect its operations, which continue as usual, but it has incurred certain expenses and expects further costs as the investigation continues. Police and regulatory agencies have been notified. The company said it intends to notify affected customers and authorities as required by applicable law.

CenterPoint Energy is a US utility that delivers electricity and natural gas. It employs roughly 8,800 people and had around $48.3 billion in assets as of June 2026.