CenterPoint Energy has told the Texas attorney general’s office that a data breach exposed personal information of 1,062,060 Texas residents, including Social Security and driver’s license numbers, SecurityWeek reported Thursday. It is the first hard count the Houston-based electric and gas utility has given since it disclosed the incident in September, and it covers only one of the four states where it serves customers.

What Happened

In a Sept. 14 filing with the Securities and Exchange Commission (SEC), CenterPoint said it learned that month of an online post by a third party claiming to hold a data set of its customer information. The company said it then determined that an unauthorized party had obtained personal information on a portion of its customers through one of its external-facing systems, meaning a system reachable from the internet. It did not name the system.

The company said electric and gas delivery was not affected. It reported the matter to law enforcement, notified certain regulators and brought in outside cybersecurity experts. It said it did not consider a material financial impact reasonably likely and expected its cyber insurance to offset related costs.

RelatedCybersecurity Incident at BAE Systems Halts Notices From U.S. Bankruptcy Courts

According to SecurityWeek, the company’s Texas filing lists names, addresses, Social Security numbers and driver’s license numbers as the exposed data. Residents of Indiana, Minnesota and Ohio may also be affected, but the total is unclear; SecurityWeek said CenterPoint had not answered its question about the overall number. The outlet also said it appears notification letters have not yet gone out to affected people.

The attacker has made larger claims that have not been verified. SecurityWeek reported that a hacker claimed on a cybercrime forum to hold nearly 7.5 million CenterPoint records and on Sept. 12 offered a 2.5-gigabyte archive for download that allegedly includes about 3 million phone numbers. CenterPoint declined to comment on the post when asked by The Record in September.

Why It Matters

Utilities are critical infrastructure, and attention usually centers on whether attackers can disrupt power or gas. This incident shows the other exposure: a utility holds identity data on millions of households, and a breach that never touches operations can still create large notification costs, regulatory scrutiny and fraud risk for customers. Social Security and driver’s license numbers together are the kind of data that can be used to open accounts in someone else’s name.

The sequence is also instructive for boards. CenterPoint learned of the theft from the attacker’s own post, and the first state-level count arrived about a month after its SEC disclosure. The company filed under Item 8.01, used for other events, rather than Item 1.05, which the SEC reserves for cybersecurity incidents a company judges material. Directors should know how quickly their own organization could determine who was affected if an attacker went public first, and which internet-facing systems hold customer records.

Context

CenterPoint serves about 7 million customers across Indiana, Minnesota, Ohio and Texas, The Record reported. The utility previously disclosed a separate breach of customer information tied to a 2023 compromise of a file-sharing platform, according to the same report.

What to Watch

Watch for counts from Indiana, Minnesota and Ohio, the timing and content of customer notification letters, and whether CenterPoint updates its SEC disclosure; its filing flagged the risk that the incident’s scope could grow beyond current expectations. Inquiries by Texas regulators or the attorney general, and any lawsuits from affected customers, would also signal how costly the breach becomes.