CenterPoint Energy Confirms Data Breach, Hacker Claims 7.49 Million Customer Records Stolen

CenterPoint Energy, the Houston-based utility that serves roughly 7 million electric and gas accounts across Texas, Indiana, Minnesota and Ohio, has confirmed that hackers stole customer data. What the company has not confirmed is how bad it really is.

The company disclosed the incident in a Form 8-K filed with the U.S. Securities and Exchange Commission on September 14, 2026. According to the filing, CenterPoint became aware in September of an online post by a third party claiming to possess a dataset of company customer information.

CenterPoint activated its incident response procedures, hired outside cybersecurity experts and locked down systems. The company's conclusion, straight from the filing: "an unauthorized third party obtained personal information relating to a portion of the Company's customers through one of the Company's external facing systems."

That is the confirmed part. Everything else right now comes from the hacker.

What the Hacker Claims

A threat actor using the alias 4d722e4d656f77 posted on a cybercrime forum on September 12 claiming to have pulled roughly 7.49 million CenterPoint customer records, according to Security Affairs. The actor said the data came in seven files totaling 2.5 GB and included customer names, phone numbers, service and billing addresses, account numbers, billing amounts, payment status and the last four digits of Social Security numbers. TechRadar, citing reporting from The Register, added that the hacker also claimed to have obtained move-in dates and driver's license information.

The hacker told BleepingComputer, as reported by CyberGuy, that the theft came through a public API CenterPoint controlled. The attacker's own words, quoted by Security Affairs: "It's quite funny to think a $26.2 billion company has WEAK protection. We obtained said data from an API they managed and controlled, which lacked proper WAF protection, rate limiting, certification protection, and no JWT/Auth token to pull said data."

The attacker claimed CenterPoint deployed a CAPTCHA mid-scrape to slow the extraction, and boasted that without it they would have pulled 17.44 million records instead of 7.49 million. The same post included a threat: "next time we won't simply pull data, we'll start attacking the main infrastructure."

None of that has been independently verified. TechRadar was explicit on this point: "No independent investigators have confirmed these claims just yet." CenterPoint's own filing does not name an API, does not confirm a record count, and does not detail which data types were exposed for which customers.

CenterPoint's Response

CyberGuy reached out to CenterPoint directly, asking whether the company could confirm the 7.49 million figure, what data was affected, and whether a public API was involved. CenterPoint's answer: "Our filing speaks for itself." No further detail.

Given that the investigation is ongoing and the scope of a breach like this often takes weeks to nail down, both careful corporate responses and stonewalling can look identical until CenterPoint says more.

What the company has said clearly: electric and natural gas delivery were not affected and continued operating normally throughout. CenterPoint also told the SEC it does not currently expect the breach to have a material impact on its financial condition, and it expects cybersecurity insurance to offset at least some of the response costs. TechRadar noted CenterPoint operates around $48.3 billion in assets and employs about 8,800 people, a different figure than the hacker's $26.2 billion claim, which appears to reference the company's market value rather than its total assets. Neither figure changes what happened to customer data.

CenterPoint says it has notified law enforcement and certain regulators and will notify affected customers and additional authorities once it determines the scope, as required under applicable law, according to Cyber Insider.

Even the confirmed portion of this breach is bad enough on its own terms. Utility accounts carry exactly the kind of information scammers use to run convincing shutoff-threat calls, fake payment-portal texts and account-verification phishing. That risk exists whether the final number turns out to be 7.49 million or a fraction of that.

There is a legitimate question about whether CenterPoint is downplaying the scope by declining to confirm or deny the hacker's specifics, and a separate legitimate question about whether the hacker is inflating the haul for street cred on a criminal forum. Both things can be true. What is not in dispute: a $48.3-billion-asset utility company had customer data pulled out through a system it controlled, and as of this writing it still has not told the public how many people were affected or what exactly was taken.

CenterPoint customers should watch for unsolicited calls, texts or emails claiming to be from the company, particularly anything demanding immediate payment or account verification. CenterPoint has not yet announced a timeline for when it will finish determining the scope of the incident or begin formal customer notifications.