HOUSTON, October 16, 2026 — CenterPoint Energy confirmed a data breach from September that exposed the names, addresses, Social Security numbers, and driver’s license numbers of more than one million customers in Texas.
The breach was disclosed in a filing with the Office of Texas Attorney General Ken Paxton, which showed that customer data had been compromised and that notifications had not yet been sent. CenterPoint Energy said it activated incident response procedures upon learning of the issue and brought in external cybersecurity, forensic, and legal advisors to assist with the investigation. The company continues to work with third-party experts to assess the full scope of the affected data and determine which customers will receive formal notifications in line with legal requirements.
What Data Was Compromised
According to the filing with the Texas Attorney General’s office, the breach included customers’ names, addresses, Social Security numbers, and driver’s license numbers. These are core identifiers that, when combined, pose a significant risk for identity theft and financial fraud. The exposure of driver’s license numbers is particularly concerning as they can be used to create fraudulent identification documents or bypass certain verification systems. No other data types, such as financial account details or utility usage patterns, were mentioned in the report.
How Many Customers Were Affected
The AG report filing states that more than one million customers were impacted by the breach. CenterPoint Energy told ABC13 in September that it was working to determine the exact number of customers whose data may have been accessed, based on a third-party online post claiming to have obtained customer information. The company has not released a more precise figure beyond “more than one million,” and the investigation remains ongoing to refine the scope.
CenterPoint’s Response and Investigation Status
CenterPoint Energy said it activated its incident response procedures after learning of the breach and engaged external cybersecurity, forensic, and legal advisors to support the investigation. The company emphasized that its delivery of electric and gas services has not been impacted and remains operational. It continues to work with third-party experts to assess which specific customers’ data was compromised so that notifications can be sent in accordance with applicable legal requirements. As of the filing, CenterPoint had not yet contacted affected customers.
Protections Being Offered to Victims
While the filing does not detail the specific protections being offered, CenterPoint Energy’s public statement to ABC13 indicated that victims would be offered free credit monitoring and identity theft protection once notifications are sent. This is a standard response in data breaches involving Social Security numbers and other sensitive personal information, intended to help individuals detect and respond to potential misuse of their data. The company has not specified the duration or provider of these services.
Why the Breach Matters for Utility Cybersecurity
Utilities like CenterPoint Energy collect and store vast amounts of personal data as part of billing and service operations, making them attractive targets for cybercriminals. This breach highlights the ongoing challenge utilities face in securing customer information, especially as digital infrastructure expands with smart meters and online account systems. The exposure of government-issued identifiers such as Social Security and driver’s license numbers increases the risk of long-term harm to individuals, underscoring the need for stronger data encryption, access controls, and breach detection protocols in the energy sector.
What Comes Next for Notification and Remediation
CenterPoint Energy said it will notify affected customers in accordance with applicable legal requirements once the scope of the breach is fully assessed. The timing of these notifications depends on the completion of the ongoing investigation by internal and external experts. Until then, the company advises customers to remain vigilant for signs of identity theft, such as unfamiliar accounts or credit inquiries, and to consider placing fraud alerts or credit freezes with major credit bureaus as a precaution. No timeline for notification completion has been provided.
Company Background and Historical Context
CenterPoint Energy, headquartered in Houston, Texas, is a Fortune 500 utility company that provides electric and natural gas services across multiple states, including Indiana, Ohio, Minnesota, and Texas. The company traces its origins to Houston Lighting & Power (HL&P), which was restructured following Texas electricity market deregulation in 2003, leading to the formation of CenterPoint Energy as a distinct entity. Over the years, CenterPoint has expanded through strategic acquisitions and partnerships, including its 2019 merger with Vectren Corporation, which was completed on February 1, 2019, and saw the Vectren name retired in 2021.
Historically, CenterPoint has managed major infrastructure challenges, such as the widespread power outages caused by Hurricane Ike in September 2008, which disrupted service for approximately 2.1 million of its 2.26 million electricity customers in the Greater Houston Area. The company has also invested in grid modernization, launching a five-year smart meter deployment program in March 2009, supported in part by federal stimulus funding, to improve energy efficiency and customer engagement.
In addition to utility operations, CenterPoint has pursued initiatives in emerging technologies, including a 2010 partnership with Ford Motor Company to promote electric vehicle adoption through consumer outreach and charging infrastructure education. These efforts reflect the company’s broader strategy to adapt to evolving energy demands while maintaining core service reliability across its service territories.
Regulatory Oversight and Potential Penalties
The Texas Attorney General’s Office, led by Ken Paxton, is the primary regulator overseeing the breach response. Under Texas law, companies that suffer a data breach involving personal identifying information must notify affected individuals “in the most expedient time possible” and may be subject to civil penalties if they fail to do so or if the breach results from inadequate security safeguards. The AG’s filing indicates that CenterPoint has not yet issued notifications, prompting the office to monitor the company’s progress closely.
Additionally, the AG may require the utility to implement a corrective action plan, including independent security audits, enhanced encryption, and mandatory employee training, to prevent future incidents.
Sources
- CenterPoint Energy
- More than 1 million customers impacted by CenterPoint Energy data breach, AG report filing shows
- More than 1 million customers impacted by CenterPoint Energy data breach, AG report filing shows
Photo: Nick Juhasz, aka Nick22aku at en.wikipedia (CC BY 2.5)
