CenterPoint Energy has confirmed that an unauthorized third party obtained personal information belonging to its customers through an external-facing system, following an online claim that millions of records associated with the U.S. utility company had been stolen.
The Houston-based energy provider disclosed the incident in a September 14, 2026, filing with the U.S. Securities and Exchange Commission. CenterPoint said it became aware earlier that month of an online post from a third party claiming to possess a dataset containing customer information.
CenterPoint activated its cybersecurity incident response procedures, launched an investigation with third-party cybersecurity experts and implemented additional measures to protect its systems.
The investigation confirmed that an unauthorized third party obtained personal information relating to a portion of CenterPoint customers. At the time of its initial disclosure, the company had not established how many individuals were affected or which categories of personal information were compromised.
October 14 update: Newly reported regulatory figures identify approximately 1.6 million affected individuals nationwide, including more than 1 million Texas residents. The exposed information reportedly includes Social Security numbers and driver’s license information. Additional details appear in the update at the bottom of this article.
Threat actor claims 7.49 million records
Before CenterPoint publicly confirmed the breach, a threat actor claimed to have obtained and released approximately 7.49 million records associated with the company’s customers.
The actor alleged that the dataset contained customer contact information, utility account and billing details, service addresses, driver’s license information and the last 4 digits of Social Security numbers, among other information.
The threat actor also made claims about how the information was obtained from CenterPoint’s systems. BreachNews is not reproducing those technical details because CenterPoint has not independently confirmed the claimed intrusion method.
CenterPoint’s SEC filing did not validate the claimed 7.49 million-record figure or confirm that all the data categories described by the threat actor were exposed.
A record count also does not necessarily represent the number of unique individuals affected, since datasets can contain multiple records associated with the same customer or account.
The subsequently reported regulatory figures identify approximately 1.6 million affected individuals, substantially fewer than the 7.49 million records claimed by the threat actor. The figures are not directly comparable because one represents people and the other represents alleged database records.
Investigation confirms customer information was obtained
CenterPoint said it was working with outside cybersecurity experts to determine the number of customers affected and the specific personal information involved.
The company also reported the incident to law enforcement and notified certain regulators. It said affected customers and regulatory authorities would receive notifications where required by law.
The October regulatory disclosure provides additional information about the scale of the incident and the types of personal information involved, although it does not establish that every affected individual had every reported data category exposed.
Questions also remain about how the unauthorized party accessed the external-facing system and whether the information advertised online corresponds in full to the data obtained during the confirmed compromise.
Electricity and natural gas services were not disrupted
Despite the compromise of customer information, CenterPoint said the incident did not affect its delivery of electricity or natural gas.
The company’s services remained operational, an important distinction given CenterPoint’s role as a major U.S. energy provider.
CenterPoint provides electric transmission and distribution, natural gas distribution and other energy services across multiple states. A cyberattack affecting operational technology or systems responsible for delivering electricity and natural gas could carry significantly different consequences from the customer data breach under investigation.
CenterPoint has not disclosed evidence indicating that the attacker gained access to systems responsible for controlling electricity or natural gas infrastructure.
The company also said it did not believe the incident was reasonably likely to have a material impact on its financial condition or operating results.
CenterPoint expects breach-related costs
CenterPoint incurred expenses associated with investigating and responding to the incident and anticipated additional costs as its response continued.
The company said it maintained cybersecurity insurance coverage that it believed would offset costs associated with the breach.
The incident also prompted proposed class-action litigation. Lawsuits filed before CenterPoint’s confirmation alleged that millions of customer records were compromised and accused the company of failing to adequately protect personal information.
Those allegations have not been adjudicated.
CenterPoint’s September confirmation established that the incident involved an actual compromise of customer personal information rather than solely an online leak claim. The subsequent regulatory disclosure has now provided a substantially clearer picture of its scale.
October 14, 2026 update: More than 1.6 million people affected
Editor’s update, October 14, 2026: This article has been updated to reflect newly reported breach figures associated with CenterPoint Energy’s previously confirmed cybersecurity incident. The figures concern the same breach reported in September, not a separate attack.
According to information attributed to an October 13 disclosure to the Texas Attorney General, the incident affected 1,611,625 individuals nationwide, including 1,062,060 Texas residents.
The reported categories of compromised information include:
- Full names
- Residential addresses
- Social Security numbers
- Driver’s license numbers
The disclosure reportedly identifies August 19 through August 22, 2026, as the period of unauthorized activity.
These details expand on CenterPoint’s original September announcement, which confirmed that customer information had been obtained but did not identify the affected population or specify the personal information involved.
The inclusion of Social Security numbers and driver’s license information raises the potential consequences for affected customers. Such information can be used in identity theft, fraudulent account applications and impersonation attempts.
However, the reported data categories should not be interpreted as confirmation that every affected individual had all 4 categories of information compromised.
The newly disclosed count also should not be confused with the threat actor’s earlier claim of 7.49 million records. Multiple records can relate to the same individual, and CenterPoint has not confirmed the authenticity or completeness of the dataset described in the original leak claim.
Affected customers should review any official breach notification they receive and pay particular attention to information about identity protection services, credit monitoring and the specific personal information involved.
Individuals whose Social Security numbers were exposed may also consider placing security freezes with the major credit reporting agencies and monitoring their financial accounts for suspicious activity.
