The short answer
CenterPoint Energy, the Houston-based utility that keeps the lights on for millions of homes and businesses, has confirmed a data breach affecting 1,062,060 Texas residents. In a filing with the Texas Attorney General, the company says the exposed data includes customer names, addresses, Social Security number information and driver’s license numbers. The unauthorized access happened between August 19 and 22, 2026, and was discovered on September 9. If you are a CenterPoint customer in Texas, treat this as a real identity-theft risk: freeze your credit, watch for convincing phishing messages that use your real account details, and do not wait for a notification letter before acting.
How the breach unfolded: a timeline
This is one of those breaches that played out in public before the company ever confirmed it. Here is the sequence, based on the company’s filings and independent reporting:
- August 19 to 22, 2026: The unauthorized access took place, according to CenterPoint’s filing with the Texas Attorney General.
- September 9, 2026: CenterPoint discovered the breach.
- September 12, 2026: A threat actor using the alias “4d722e4d656f77” posted on a cybercrime forum claiming to have extracted roughly 7.49 million customer records from CenterPoint, and offered a 2.5-gigabyte archive for download that reportedly contained around 3 million phone numbers plus other personal details.
- September 14, 2026: CenterPoint filed a Form 8-K with the U.S. Securities and Exchange Commission, confirming that an unauthorized third party obtained personal information relating to a portion of its customers through one of its external-facing systems. Notably, the company filed this as an “Other Events” disclosure rather than a formal material cybersecurity incident.
- October 13, 2026: CenterPoint filed its breach report with the Texas Attorney General’s office, putting an official number on the Texas impact: 1,062,060 residents, with 1,611,625 affected individuals overall.
What data was exposed
The Texas Attorney General filing lists four categories of compromised information:
- Names
- Addresses
- Social Security number information
- Driver’s license numbers
That combination is exactly what identity thieves need. A name plus an address plus a Social Security number can be used to open credit accounts, file fraudulent tax returns and impersonate you to banks and government agencies. Driver’s license numbers add fuel: they can be used for fake IDs and to pass identity-verification checks that ask for ID details.
There is an uncomfortable detail here. The attacker’s claimed sample data showed only the last four digits of Social Security numbers, but the company’s own filing lists “Social Security number information” without saying whether it is full or partial, and it also names driver’s license numbers, which did not appear in the attacker’s list. In other words, the company’s confirmed picture is worse than what the hacker advertised. That kind of gap between an attacker’s claims and a company’s filing is not unusual, similar to how companies sometimes initially understate an incident’s scope, as seen with the disputed ASOS breach claims. Treat the company’s filing as the authoritative version until notification letters say more.
How the attackers reportedly got in
According to the threat actor’s own account, reported by BleepingComputer and other outlets, the records were not stolen with malware or a stolen password. The attacker says they pulled the data through a public-facing CenterPoint API that lacked rate limiting, web application firewall protection and proper authentication, simply cycling through millions of customer IDs over days or weeks.
CenterPoint has not confirmed that method. Its SEC filing says only that the data was obtained through one of the company’s “external facing systems.” But if the attacker’s description is accurate, it is a familiar and damning pattern: a customer-facing web endpoint that happily answers every request, with nobody noticing millions of lookups. For context on how dangerous exposed customer data stores can be, see the Revolut breach, where criminals combined stolen customer data with official-looking impersonation scams.
One line from the attacker’s forum post deserves attention: after dumping the data, the actor warned that next time it would not simply pull data but would “start attacking the main infrastructure.” Security researchers take such threats seriously when they come from an actor that has already demonstrated access, and CenterPoint says its electric and gas delivery was not disrupted and remains operational.
What CenterPoint has said, and what it has not
CenterPoint has said it activated its incident-response procedures, hired outside cybersecurity, forensic and legal advisors, reported the matter to law enforcement and notified regulators. A company spokesperson said it continues to work with third-party experts to assess the scope and identify which customers will be notified under applicable law.
What it has not done, at least as of its Attorney General filing, is send notification letters to affected individuals. That is a genuine problem: the people most at risk may have no idea their data is circulating. The company has said it does not expect the breach to have a material financial effect and expects its cyber insurance to help offset costs. Multiple proposed class-action lawsuits have already been filed in federal court, with law firms alleging a breach window from about August 17 to September 1, per BleepingComputer’s reporting.
Are you affected? How to know
CenterPoint serves about 7 million metered customers across Texas, Indiana, Ohio and Minnesota, and about 2.8 million electric meters in the Houston area. The confirmed figure of 1,062,060 Texans is only the state count, not the total; the filing lists 1,611,625 affected individuals overall, and the attacker’s claimed 7.49 million records remain unverified.
Right now, the honest answer is that you may not be able to confirm whether your data was included. CenterPoint has said notification letters will go to affected customers once the scope is determined. But waiting for a letter is the worst strategy here, because the stolen data has been circulating for weeks. Assume you are affected if you are a current or recent CenterPoint customer, especially in Texas, and take the steps below now.
What to do now: a step-by-step checklist
1. Freeze your credit with all three bureaus
This is the single most effective step. A credit freeze stops anyone from opening new accounts in your name, and it is free. Contact Equifax, Experian and TransUnion directly (through their official websites, which you navigate to yourself, never through a link someone sends you). You will get a PIN to lift the freeze temporarily when you apply for credit yourself. A fraud alert is a weaker alternative if you do not want a full freeze.
2. File an Identity Theft Report with the FTC
If you see any sign of misuse, go to IdentityTheft.gov, the Federal Trade Commission’s official site, and file a report. It generates a personal recovery plan and an Identity Theft Report you can use with creditors and police.
3. Watch for hyper-convincing phishing and vishing
This is where this breach gets dangerous. The stolen data includes names, phone numbers, email addresses, service and billing addresses, account numbers, billing amounts and payment information. That is enough to craft phishing emails and texts that look exactly like CenterPoint: a fake “disconnection notice” or “past-due bill” arriving in your inbox with your real account number and address in it. Treat every unexpected message from “CenterPoint” as suspect. Never click links or call numbers in messages you did not request; go to centerpointenergy.com yourself or call the number on your bill.
4. Protect your driver’s license information
Driver’s license numbers are less commonly exposed than Social Security numbers, so thieves can use them in ways you might not expect, including identity-verification bypasses. Texas residents can contact the Texas Department of Public Safety about a driver license fraud alert. Keep an eye on your driving record and any mail from the DPS.
5. Guard against tax fraud early
With Social Security numbers in the mix, filing your taxes early, as soon as you have your documents, closes the window for criminals to file a fraudulent return in your name. The IRS also offers an Identity Protection PIN program that adds a six-digit code to your return.
6. Monitor your accounts and your mail
Review bank and credit card statements for unfamiliar charges, no matter how small. Criminals often test with small transactions first. Watch for unexpected mail: new credit cards, account confirmations or collection notices you did not initiate. Consider free credit monitoring from the bureaus as a supplement, not a substitute, for a freeze.
Why this one matters beyond Texas
Large utility breaches keep happening because customers cannot opt out: you cannot get electricity without handing your provider your personal and billing information. The CenterPoint incident follows a pattern of major 2026 breaches where sensitive data sat behind internet-facing systems, from the Pentagon’s DMDC breach exposing military records to the ConnectWise compromise that reached Microsoft 365 tenants. For CenterPoint, the uncomfortable question regulators and lawsuits will now ask is how an API that allegedly lacked basic rate limiting was answering requests for millions of customer records without triggering alarms. The company’s answer to that question will matter a great deal to the 1.6 million people whose data is now out there.
Frequently asked questions
How do I know if my data was in the CenterPoint breach?
As of mid-October 2026, CenterPoint had not sent notification letters, so there is no official lookup tool yet. The company says it will notify affected customers as required by law once it finishes determining the scope. If you are a current or recent CenterPoint customer, especially in Texas, assume your data may be included and take protective steps now rather than waiting for a letter.
What exactly was stolen in the CenterPoint Energy data breach?
According to CenterPoint’s filing with the Texas Attorney General, the compromised data includes names, addresses, Social Security number information and driver’s license numbers. The attacker also claimed the data set included phone numbers, email addresses, account and premise identifiers, billing amounts, payment information and autopay status, but the company has not confirmed that full list.
Did the breach affect CenterPoint’s electricity or gas service?
No. CenterPoint says the incident did not disrupt electric or natural gas delivery, which remained operational. The breach involved customer data in an external-facing system, not operational technology.
Is the CenterPoint breach notification letter real or a scam?
Real notification letters, when they arrive, will match the breach CenterPoint reported to the Texas Attorney General on October 13, 2026. A legitimate notice will not ask for your password, Social Security number or a payment. If you receive one, verify it by contacting CenterPoint through the phone number on your bill or the website you navigate to yourself, not through any link or number in the letter.
Can I join a lawsuit over the CenterPoint data breach?
Multiple proposed class-action lawsuits have already been filed in federal court over the breach. Class actions generally include affected customers automatically if a settlement is reached, and you would be notified. Keep any notification letter you receive, since it documents that your information was involved. This article is not legal advice; consult an attorney for guidance about your situation.
How many people were affected by the CenterPoint breach?
CenterPoint told the Texas Attorney General that 1,062,060 Texas residents were affected, with 1,611,625 affected individuals in total across the states it serves. A threat actor separately claimed to have stolen about 7.49 million records, but CenterPoint has not confirmed that figure and it should be treated as unverified.