CenterPoint Energy has confirmed that a threat actor stole customer personal information by exploiting an unprotected public API, with the attacker claiming to have taken 7.49 million records including partial Social Security numbers.
CenterPoint Energy has confirmed that an unauthorized party stole personal information belonging to a portion of its customers after a threat actor exploited weaknesses in one of the utility's external-facing application programming interfaces, the company disclosed in a filing with the U.S. Securities and Exchange Commission.
The breach, first reported by BleepingComputer, came to light after a threat actor using the alias "4d722e4d656f77" told the publication they had exfiltrated 7.49 million customer records from the Houston-based utility.
The stolen data allegedly includes names, phone numbers, service and billing addresses, account numbers, billing amounts, and partial Social Security numbers.
The threat actor claimed to have harvested the records by iterating through millions of IDs on CenterPoint's public API, which they said lacked rate limiting, web application firewall protection, and other controls against automated access. The attacker said they leaked the data publicly after the company ignored their communications.
In its SEC filing, CenterPoint confirmed an unauthorized third party obtained customer personal information but did not specify the number of affected individuals or detail the categories of compromised data. "The Company is continuing to work with third-party experts to determine the scope of customers and personal information affected by the incident and intends to notify affected customers and regulatory authorities as required by applicable law," the filing states.
CenterPoint serves approximately 7 million metered customers across Indiana, Minnesota, Ohio, and Texas, and generates over $9.3 billion in annual revenue. The company employs roughly 8,300 people.
The company said its electric and gas services were not disrupted by the incident and that it does not believe the breach will materially affect its business or financial condition.
CenterPoint said it has activated its incident-response procedures, retained third-party cybersecurity experts, strengthened protections on affected systems, and reported the matter to law enforcement and regulators.
Litigation followed quickly. Multiple law firms have filed proposed class-action lawsuits against CenterPoint in federal court on behalf of potentially affected customers, alleging the breach occurred between August 17 and September 1.
The incident reinforces a recurring vulnerability pattern in which customer-facing APIs are exposed to automated enumeration attacks — a risk that organizations handling sensitive utility and billing data have struggled to address consistently across large, distributed infrastructures.
With its investigation still ongoing and customer notification yet to be completed, CenterPoint faces both regulatory scrutiny and civil liability, while affected customers await clarity on the full extent of what personal information may have been compromised.
Sara Montes de Oca is the Editor in Chief of TechEchelon. Previously a correspondent and producer in Washington, D.C., covering business, finance, and politics.
More from Sara →Japan's Digital Agency has disclosed a breach in which an attacker exploited a VPN vulnerability to access a government system, potentially exposing 246,000 rows of personnel records including names, email addresses, and telephone numbers.
Revolut confirmed it exposed sensitive customer data — including passport copies and transaction histories — after fraudulent requests were submitted using a legitimate government agency's email domain. The fintech said a "limited" number of customers were affected and that company systems and funds remain unaffected.
A security update shipped as part of Microsoft's September 2026 Patch Tuesday is breaking copy-and-paste and formula dragging in Excel across multiple Office versions, with users reporting that removing the patch restores functionality.
Written for readers who already know the basics — markets, AI, and the policy decisions that shape both.