CenterPoint Energy has told the Texas attorney general that 1,062,060 Texans were caught up in the customer data breach it first acknowledged last month. The number appears in the state’s public breach database, according to a KPRC report published Oct. 14, and it puts an official figure on a breach whose size the company had not previously disclosed.
The same filing lists what was exposed: customers’ names, addresses, Social Security information and driver’s-license numbers. It also records that the affected consumers had not yet been notified when the report was submitted, which means many of the people in that total may still be waiting to learn their data was taken.
Texas attorney general breach report
KPRC reporter Jaewon Jung wrote that the attorney general’s breach database lists the number as 1,062,060 Texans, and that the report was posted on the office’s website on Monday. According to the KPRC story, the entry carries a caveat: the count of affected Texans and the notification status may be updated later. The combination of identifiers is the part that draws concern, since a Social Security number and a driver’s-license number are far harder to replace than a password or a credit card. Treat 1,062,060 as the figure reported so far for Texas residents only, and as a number that could move.
Texas law, as the report summarizes it, requires a business to tell the attorney general about a breach affecting at least 250 Texans as soon as practicable and no later than 30 days after discovery. Individuals generally must be notified without unreasonable delay and no later than 60 days after the company determines that a breach occurred. The report does not say whether CenterPoint has crossed either deadline.
CenterPoint’s disclosure timeline
CenterPoint disclosed the incident on Sept. 14 in a Form 8-K filed with the Securities and Exchange Commission. The filing said the company became aware in September of an online post by a third party claiming to have a dataset containing some of its customer information. CenterPoint later determined that an unauthorized third party obtained personal information relating to a portion of its customers through an external-facing system. It did not say how many customers were affected or what categories of data were taken, so the Texas filing supplies detail that the securities disclosure left out.
The company activated its cybersecurity incident response protocols, began an investigation with outside experts, took steps to further protect its systems, reported the matter to law enforcement and notified certain regulators. It said it expected to incur expenses, carries customary cybersecurity insurance that it believes will offset related costs, and does not expect a material effect on its finances. The filing also warned that the incident’s scope could prove greater than initially expected.
The hacker’s claim and how it compares
The 8-K was not the first public sign of trouble. According to Security Affairs, a user posting under the alias 4d722e4d656f77 claimed on Sept. 12 to hold about 7.49 million customer records and offered a 2.5 GB archive. Help Net Security reports the same poster said an API lacked authentication, rate limiting and certificate checks, and that more than 7.49 million lines had been pulled.
Those assertions are unverified. CyberInsider notes that CenterPoint has not confirmed the 7.49 million figure or the authenticity of the dataset, and the poster’s fields, which include phone numbers, billing amounts and the last four digits of Social Security numbers, do not map neatly onto the Texas filing’s list. The two numbers also measure different things: one is a hacker’s boast about lines of data, the other is a regulatory count of Texas residents. Security Affairs says the utility serves about 7 million accounts across Texas, Indiana, Minnesota and Ohio, so a Texas total above one million fits inside a much larger footprint.
Litigation has followed the disclosure. Help Net Security, citing local media, says several class action lawsuits from customers in multiple states have been filed. The 8-K does not mention lawsuits, and CyberInsider’s account does not either, so the claim rests on that secondary report; none of the court filings were reviewed here, and any complaint’s allegations about how the data was exposed remain allegations until a court rules.
CenterPoint’s response to customers
A CenterPoint spokesperson said Wednesday that the company “continues to actively investigate the cybersecurity incident disclosed last month,” is working with third-party experts to assess the scope of affected customer data and identify which customers will receive notifications, and that electric and gas delivery “has not been impacted and remains operational and undisrupted.” KPRC’s report does not say how the breach happened, who the third party is, or whether credit monitoring will be offered, and none of those answers is in the filings reviewed here. Until the company publishes its own customer count and a notification timeline, the Texas attorney general’s database entry is the most concrete public measure of the damage.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
More from Morning Overview
- The FBI told the rest of ShinyHunters to surrender after a 24-year-old was arrested
- Two passengers died at an Ohio toll plaza, and the NTSB now wants the cash lanes shut
- Long use of a common prostate pill is tied to a higher chance of glaucoma
- Ford is recalling 223,472 F-150 pickups because the fuel tank can leak or detach
