CenterPoint Energy Confirms Breach After Attacker Claims 7.49 Million Records Stolen
CenterPoint Energy, a Houston-based utility serving roughly 7 million electricity and natural gas customers across Texas, Indiana, Minnesota, and Ohio, has confirmed that an unauthorized party stole customer personal information through one of its external-facing systems. The company disclosed the breach in a filing with the US Securities and Exchange Commission after a threat actor published an online claim of having stolen 7.49 million customer records.
The attacker, using the alias “4d722e4d656f77,” told reporters the stolen data included names, phone numbers, service and billing addresses, account numbers, billing amounts, and partial Social Security numbers. The individual claimed the information was pulled by systematically iterating through customer ID numbers on a CenterPoint public API that lacked rate limiting or web application firewall protections, and said they leaked the data after the company failed to respond to their messages. CenterPoint’s SEC filing did not name the attacker, confirm the number of affected customers, or specify which categories of data were exposed, saying only that its investigation is ongoing.
The company said its core electric and gas services were not disrupted and that it does not currently expect the incident to materially affect its business or finances. It has since engaged outside cybersecurity experts, tightened protections on the affected systems, and reported the breach to law enforcement and regulators, with plans to notify affected customers as required by law. Multiple proposed class-action lawsuits have already been filed in federal court on behalf of potentially affected customers, alleging the breach occurred between August 17 and September 1. The incident adds to a string of recent breaches at large utilities and infrastructure providers stemming from inadequately secured public-facing APIs, a pattern security researchers say attackers are increasingly exploiting at scale rather than through traditional network intrusion.