The data was online before the company said a word. On 12 September, a hacker posted on a cybercrime forum that they had stolen nearly 7.5 million CenterPoint Energy customer records. Two days later the Houston utility told the SEC the claim was true, at least in part.
In its filing, CenterPoint said an unauthorized third party “obtained personal information relating to a portion of the Company’s customers through one of the Company’s external facing systems.” The company did not name the attacker, say how many customers were affected or list the data types involved. That is the detail that matters to anyone trying to judge their own exposure, and it remains open.
What the hacker says
BleepingComputer reported that an actor using the alias “4d722e4d656f77” claimed to have taken 7.49 million records. They allegedly include names, phone numbers, service and billing addresses, account numbers, billing amounts and partial Social Security numbers. The hacker told the outlet the company ignored their messages and treated them as a joke, so the data was leaked.
As to method, the intruder said they simply iterated through millions of IDs on CenterPoint’s public API. Under the hood, that is the unglamorous kind of attack: no exploit, just a loop. The hacker claimed the API had no rate limiting and no web application firewall to stop automated access. None of this is confirmed by the company.
SecurityWeek, which saw a 2.5 GB archive offered for download, said it could not verify the data, and noted that hackers often exaggerate. It also recorded a threat in the forum post: “next time we won’t simply pull data, we’ll start attacking the main infrastructure.”
The company’s response
CenterPoint said power and gas deliveries were not affected and that it does not expect a material impact on its finances. It has activated its incident-response procedures, hired outside cybersecurity experts, tightened protections and reported the matter to law enforcement and regulators. It intends to notify affected customers and regulators as the law requires. Costs will be offset by its cybersecurity insurance, it said.
Lawsuits arrived quickly. BleepingComputer reported multiple proposed class actions in federal courts, brought by law firms for potentially affected customers, alleging the breach took place between 17 August and 1 September.
CenterPoint serves about 7 million metered customers in Indiana, Minnesota, Ohio and Texas. It is not the first time hackers have claimed its data. In 2024 an access broker called AntiBrok3rs was among those targeting energy companies, and the data in those earlier claims was believed to trace back to the Cl0p ransomware group’s 2023 MOVEit campaign, via a third party rather than CenterPoint’s own systems.
Sources
- CenterPoint Energy confirms customer data stolen in cyberattack
- Texas Utility CenterPoint Energy Confirms Breach After Hacker Leaks Data
- CenterPoint Energy Data Breach 2026: 7.49M Customer Records Stolen via API
