CenterPoint Energy Confirms Customer Data Breach After Dark-Web Leak Claim

CenterPoint Energy disclosed in an SEC 8-K filing that an attacker accessed customer personal information through an internet-facing system after the utility identified a dark-web post offering alleged CenterPoint data. The company said the investigation confirmed unauthorized access affecting an undetermined number of customers, while the threat actor claimed to possess roughly 7.5 million records containing names, contact details, account and billing information, service data, and the last four digits of Social Security numbers. CenterPoint has not confirmed the actor's claimed record count or full dataset, and electricity and natural-gas operations were not disrupted.

The Houston-based utility reported the incident to law enforcement and is engaging third-party specialists to establish its scope and issue required notifications. It also faces five proposed federal class-action suits; three allege its guest bill-pay feature exposed personal information when users entered account numbers, though those allegations have not been established in the company's disclosure.