HOUSTON, September 16 — CenterPoint Energy has confirmed that an unauthorized third party obtained personal information belonging to a portion of its customers through one of its external-facing systems, the Houston-based electric and natural gas utility disclosed in a filing with the U.S. Securities and Exchange Commission on Monday. The company said it became aware in September 2026 of an online post by a third party claiming to have obtained a dataset containing certain customer information. After investigating the claim, CenterPoint determined it was true.
Under the hood, the sequence matters. CenterPoint said it promptly activated its cybersecurity incident response protocols, initiated an investigation with the assistance of third-party cybersecurity experts, and took steps to further protect its systems.
The filing did not specify how many customers were affected or what types of personal information were involved — the detail that matters most to anyone trying to assess their own exposure.
Services Unaffected, Financial Impact Uncertain
CenterPoint said its delivery of electric and gas services has not been impacted and remains operational and undisrupted. As of the date of the filing, the company said it does not believe it is reasonably likely that there will be a material impact on its financial condition or results of operations. The company is continuing to work with third-party experts to determine the scope of customers and personal information affected.
It intends to notify affected customers and regulatory authorities as required by applicable law. CenterPoint reported the matter to law enforcement authorities and has notified certain regulatory authorities.
The company said it has incurred, and expects to continue to incur, certain expenses related to the incident and its response, and that it maintains customary cybersecurity insurance coverage that it believes will offset related costs.
What to Watch
CenterPoint Energy serves millions of customers across several states, including Texas, Indiana, Ohio, Louisiana, Minnesota, and Mississippi, and is one of the largest combined electric and gas utilities in the United States. The scope of the affected customer base remains undetermined, and the company has not indicated when it expects to complete its investigation or begin notifications. For now, the filing leaves the central questions — who was affected, and what data was taken — unanswered.
