CenterPoint Energy Data Breach: 1,062,060 Texans Affected

CenterPoint Energy has confirmed that an unauthorized third party obtained customers' personal information through one of the Houston-based utility's external-facing systems, and a notice the company filed with the Texas Attorney General's Office puts the confirmed toll at 1,062,060 Texas residents, with names, addresses, Social Security numbers, and driver's license numbers exposed. That official figure is far smaller than the roughly 7.49 million records a hacker has claimed to have stolen in posts on a cybercrime forum — a claim CenterPoint has not verified and that should be treated as an allegation, not a confirmed fact, until the company's investigation concludes.

What happened

CenterPoint Energy, the publicly traded utility that delivers electricity and natural gas to millions of customers across Texas, Indiana, Minnesota, and Ohio, disclosed the incident in a Form 8-K filed with the U.S. Securities and Exchange Commission on September 14, 2026. The filing says the company "determined that an unauthorized third party obtained personal information relating to a portion of the Company's customers" and that this happened "through one of the Company's external facing systems." CenterPoint says it activated its cybersecurity incident-response procedures, engaged outside specialists, and notified law enforcement after becoming aware of an online post claiming to hold a dataset of customer information.

Crucially, the 8-K is narrow by design. It does not name a number of affected customers, does not describe how the attacker got in beyond the "external facing systems" phrase, and does not identify which specific data fields were taken. Those gaps are part of why the story has splintered into a confirmed, official number and a much larger, unverified claim — two figures that this article keeps carefully separate.

The confirmed number: 1,062,060 Texans, per the state filing

The one hard figure available so far comes not from CenterPoint's SEC disclosure but from a separate filing the company made with Texas regulators. Under Texas's breach-notification law, companies must report breaches affecting state residents to the Texas Attorney General's Data Security Breach Reports system. That state filing — reported in mid-October 2026 — lists 1,062,060 Texas residents as affected, with the exposed data categories listed as names, addresses, Social Security numbers, and driver's license numbers.

That is the number this article treats as confirmed, because it comes from CenterPoint's own notification to a government regulator, not from a criminal's unverified forum post. It is also, notably, a Texas-only figure. CenterPoint serves customers in three other states, and the company has not published a total, company-wide count of affected individuals across its full service territory.

The unverified hacker claim: 7.49 million records

Separately from anything CenterPoint has confirmed, a threat actor operating under the alias "4d722e4d656f77" posted on a cybercrime forum around September 12, 2026, claiming to have exfiltrated approximately 7.49 million customer records from CenterPoint. This is an allegation made by a criminal actor attempting to sell or publicize stolen data — it is not a verified fact, and readers should treat it accordingly.

The forum post reportedly described a far larger haul than the confirmed Texas figure, and reportedly claimed the data included additional fields such as phone numbers, billing addresses, account numbers, and billing amounts, on top of driver's license numbers and partial Social Security numbers. CenterPoint has not confirmed the authenticity of that dataset, the accuracy of the claimed record count, or the attacker's description of how the data was obtained. Until CenterPoint's own investigation independently verifies or rebuts those details, the 7.49 million figure should be reported as an alleged, unauthenticated claim — not as a confirmed breach total.

It's also worth being precise about what isn't yet known: whether the ~7.49 million figure includes out-of-state customers, duplicate or partial records, or data that doesn't actually trace back to this incident at all. Scraped or recombined datasets claimed by forum sellers have, in other breaches, later turned out to be inflated, stale, or merged from multiple sources.

What CenterPoint's SEC filing says — and doesn't

CenterPoint's Form 8-K filed with the SEC, under Item 8.01 ("Other Events"), is a corporate disclosure aimed primarily at investors, and its language reflects that. The filing states plainly that "the Company's delivery of electric and gas services has not been impacted and remains operational and undisrupted," and that CenterPoint "does not believe it is reasonably likely that there will be a material impact" on its financial condition or results of operations. The company also said it expects to incur incident-response expenses, which it believes its cybersecurity insurance will offset in part.

What the filing conspicuously does not include is a customer count, a root-cause explanation beyond "external facing system," or a timeline for when the exposure began or ended. CenterPoint has said its investigation is ongoing, which is standard language in early-stage breach disclosures, but it also means several of the most important questions — how many people are affected company-wide, exactly which systems were touched, and how the attacker got in — remain open more than a month after the SEC filing and even after the Texas-specific number became public.

Timeline of the disclosure

Why this data matters: names, SSNs, and driver's license numbers

Unlike breaches limited to email addresses or hashed passwords, the data categories named in CenterPoint's Texas filing — full names paired with addresses, Social Security numbers, and driver's license numbers — are exactly the combination needed to commit identity theft, open fraudulent credit accounts, file fake tax returns, or pass identity checks at financial institutions. This is a materially more serious exposure than a typical marketing-database leak, which is why the Texas notification law requires this level of specificity about data types, and why security teams treat SSN-plus-address breaches differently from, say, a leaked customer-support ticket database.

It's also the kind of exposure that tends to outlast the initial headlines. Stolen Social Security numbers and driver's license numbers don't expire, can't be reissued as easily as a credit card number, and can be used for fraud months or years after a breach is disclosed — which is part of why identity-monitoring and credit-freeze advice (below) focuses on sustained vigilance rather than a one-time check.

Operations were not affected, company says

One point on which CenterPoint has been unambiguous: its core utility operations were not disrupted. The SEC filing states that electric and gas delivery "has not been impacted and remains operational and undisrupted." That distinction matters for a critical-infrastructure operator — this was a data-exposure incident involving customer records, not an operational-technology intrusion affecting the grid or gas distribution systems themselves, based on what the company has disclosed to date.

Open questions CenterPoint hasn't answered publicly

Several basic facts remain unresolved in CenterPoint's own public statements:

• How many customers, in total, across all four states CenterPoint serves, had data exposed — the 1,062,060 figure is Texas-only.
• What specific vulnerability or access point in the "external facing system" the attacker exploited.
• Whether the attacker's claimed 7.49 million record count has any basis, is inflated, or includes data not actually tied to this incident.
• When notification letters will go out to affected individuals — as of mid-October 2026 reporting, it did not appear that individual notification letters had yet been mailed.

CenterPoint has said it will notify affected customers and additional regulators as required by law, and that its investigation is continuing; updates, if any, are most likely to surface first in further SEC filings under the company's EDGAR record. This article will be a point of reference as those answers emerge; for now, readers should rely only on the confirmed Texas figure and the SEC filing's own language, not on the hacker's claims, when assessing their own exposure.

Protecting accounts beyond this one breach

Breaches involving identity documents are a useful reminder that password reuse compounds the damage of any single incident. A password manager that generates and stores unique credentials for every account limits how far a single leak — this one or a future one — can spread; our comparison of LastPass and 1Password breaks down the tradeoffs if you don't already use one. It's also worth remembering that breach notices themselves are frequently impersonated by scammers — a tactic documented in our coverage of a fake VPN site that phished IT credentials by mimicking a trusted vendor's real update process.

CenterPoint is also not the only utility or infrastructure-adjacent company to disclose a significant data exposure this year; our report on the ConnectWise cloud backup breach covers a similar pattern of a third-party-facing system being the point of entry, with downstream customer data exposed as a result.

What happens next

CenterPoint says its investigation is ongoing, and several things are likely to happen over the coming weeks: formal notification letters to affected Texas residents (and potentially residents of CenterPoint's other service states, if they're found to be affected), possible additional regulatory filings as the scope becomes clearer, and continued scrutiny of whether the attacker's 7.49-million-record claim holds up against the company's own count. Multiple customers have already filed putative class-action lawsuits over the incident in federal court; those are allegations in litigation, not independent findings, and don't change what CenterPoint itself has confirmed.

For now, the responsible way to describe this incident is in two layers: a confirmed, state-filed figure of 1,062,060 affected Texas residents with names, addresses, Social Security numbers, and driver's license numbers exposed, and a separate, unverified hacker claim of roughly 7.49 million records that CenterPoint has not authenticated. Readers, and other outlets, should keep those two numbers clearly separated until CenterPoint's investigation produces an official, company-wide total.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage