CenterPoint Energy data breach exposes over 1 million Texas residents
CenterPoint Energy disclosed that a data breach in September 2026 exposed personal information of over 1 million Texas residents. On September 12, 2026, a user claiming the alias '4d722e4d656f77' posted on a cybercrime forum that he had compromised approximately 7.49 million customer records; CenterPoint Energy learned of the incident two days later and reported it to the U.S. Securities and Exchange Commission.
Earlier story. First reported Oct 18, 2026 at 2:43 am; added to this site Oct 21, 2026. Details may have changed since.
- When it happened
- September 12, 2026 (breach claimed on cybercrime forum); (CenterPoint Energy learned of incident); reported to SEC thereafter
- Where
- Houston (CenterPoint Energy headquarters); Texas (affected residents)
- First reported by an outlet
- Oct 18, 2026 at 2:43 am
- Confirmed by
- 2 independent outlets
Taxes & money
None stated in sources.
Who's involved
- CenterPoint Energy · Houston-based utility provider[2]
The facts
- CenterPoint Energy notified Texas authorities that a data breach affects 1,062,060 residents of Texas, according to the Texas Attorney General's data breach database [1].[1]
- The exposed data includes names, addresses, Social Security numbers and driver's license numbers [1].[1]
- Houston-based CenterPoint Energy distributes electricity and natural gas to about seven million customers in Texas, Indiana, Minnesota and Ohio [1].[1]
- On September 12, 2026, a user with the alias '4d722e4d656f77' claimed on a cybercrime forum that he had compromised approximately 7.49 million customer records and made a 2.5 GB file available for download [1].[1]
- According to the threat actor's claims, the data was allegedly accessed through a company-managed API that lacked adequate authorization and rate-limiting controls [2].[2]
- CenterPoint Energy said its delivery of electric and gas services has not been impacted and remains operational and undisrupted [2].[2]
- Texas law requires companies to report any breach affecting at least 250 residents to the Attorney General within 30 days, and to notify affected people no later than 60 days after they discover the breach [1].[1]
Who said what
- The threat actor using the alias '4d722e4d656f77' The API lacked proper application firewall protection, rate limiting, or authentication, and the company only tried to stop the extraction after millions of records had already been extracted[1]
- CenterPoint Energy An unauthorized third party obtained personal information relating to a portion of the company's customers through one of the company's external facing systems[2]
- CenterPoint Energy It does not believe it is reasonably likely that there will be a material impact on the company's financial condition or results of operations[2]
Where sources disagree
- The threat actor claims approximately 7.49 million customer records were compromised[1,2]
- CenterPoint Energy determined that 1,062,060 Texas residents were affected, as reported to the Texas Attorney General[1]
- Over 1.6 million individuals' sensitive personal information was compromised according to one report[2]
Sources
- News Not rated CenterPoint Energy: Data leak of 1 million Texas residents SecNews.gr · Oct 18, 2026
- News Not rated News - CenterPoint Energy data breach affected over 1.6 million individuals teiss · Oct 19, 2026
Written by AI from the sources above, under fixed rules: every fact is cited, claims are kept apart from facts, and dollar figures appear only when a source states them. Mistakes get corrected in public.