Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

CenterPoint Energy customer data leak

Data Leak
First reported
Last updated
Happening score
H score 33
1 unique sources, 1 articles

Summary

Hide ▲

CenterPoint Energy confirmed a breach after an attacker leaked allegedly stolen customer records, exposing personal and billing data for a large portion of its customer base. The leak claim covers 7.49 million records and includes names, phone numbers, addresses, account numbers, billing amounts, and partial SSNs. The intruder said the data was taken through the utility’s public API without rate limiting or WAF protection. Electric and gas services were not impacted, but the exposure creates ongoing privacy and fraud risk.

Related Happenings

CenterPoint Energy hit by network compromise

Incident
H score33 First: 15.09.2026 19:40 Last: 15.09.2026 19:40 Sources 1

How related: “While the investigation remains ongoing, the Company has determined that an unauthorized third party obtained personal information relating to a portion of the Company’s customers through one of the Company’s external-facing systems,” reads the SEC filing.

About this happening: CenterPoint Energy disclosed a customer data breach after an unauthorized third party obtained personal information through an external-facing system, putting a po...

Open Happening

Timeline

  1. 15.09.2026 19:40 2 articles · 2h ago

    CenterPoint Energy discloses customer data breach after unauthorized access to an external-facing system

    Initial Disclosure

    CenterPoint Energy disclosed that an unauthorized third party obtained personal information relating to a portion of its customers through one of the company’s external-facing systems. A threat actor using the alias “4d722e4d656f77” claimed to have stolen 7.49 million customer records and leaked names, phone numbers, service and billing addresses, account numbers, billing amounts, and partial Social Security numbers after iterating through millions of IDs on CenterPoint’s public API without rate limiting or WAF protection. CenterPoint Energy said its electric and gas services were not impacted, activated incident-response procedures, hired third-party cybersecurity experts, strengthened protections on its systems, and reported the incident to law enforcement and regulators.

    Show sources
    Open in new tab