CenterPoint Energy, a Houston-based utility company, has confirmed a significant data breach involving customer information. The announcement follows claims made by a hacker who boasted of stealing a vast amount of data.
Extent of the Breach
CenterPoint Energy serves approximately 7 million customers across Indiana, Minnesota, Ohio, and Texas with electricity and natural gas. The company reported to the SEC that an investigation is underway after discovering that an unauthorized party accessed customer information through one of its external systems.
Despite the breach, the company assured that the incident has not disrupted the supply of electric and gas services. It further stated that the breach is unlikely to have a significant financial impact.
Hacker’s Claims and Threats
The breach was publicized after a hacker leaked the allegedly stolen data on a well-known cybercrime forum on September 12. The hacker claimed to have accessed nearly 7.5 million user records and threatened further attacks on the infrastructure.
An archive file purportedly containing the stolen data, measuring 2.5 GB, has been made available for download by the threat actor. However, the authenticity of the data remains unverified, as hackers often exaggerate such claims.
Historical Context and Security Measures
This is not the first instance of CenterPoint Energy facing cybersecurity threats. In 2024, the company was targeted by an access broker, and later, a different hacker claimed to have obtained its data, linked to the Cl0p ransomware group’s 2023 MOVEit campaign.
These incidents suggest that some of the data may have originated from third-party sources rather than directly from CenterPoint’s systems. The company is likely reviewing its security measures to prevent future breaches.
As cybersecurity threats continue to evolve, companies like CenterPoint Energy must remain vigilant and proactive in safeguarding their systems and customer information.
