Loading story…
CenterPoint Energy disclosed in an SEC 8-K filing that an attacker accessed customer personal information through an internet-facing system after the utility identified a dark-web post offering alleged CenterPoint data. The company said the investigation confirmed unauthorized access affecting an undetermined number of customers, while the threat actor claimed to possess roughly 7.5 million records containing names, contact details, account and billing information, service data, and the last four digits of Social Security numbers. CenterPoint has not confirmed the actor's claimed record count or full dataset, and electricity and natural-gas operations were not disrupted.
The Houston-based utility reported the incident to law enforcement and is engaging third-party specialists to establish its scope and issue required notifications. It also faces five proposed federal class-action suits; three allege its guest bill-pay feature exposed personal information when users entered account numbers, though those allegations have not been established in the company's disclosure.
See attribution, scope, and your downstream exposure.
7 events from the most recent confirmed update back to the earliest known activity.
A hacker claiming to have stolen nearly 7.5 million CenterPoint customer records posted an alleged 2.5 GB archive on a cybercrime forum and threatened that future activity would target the utility's main infrastructure. The validity and scope of the purported dataset had not been independently verified.
A threat actor using the handle “4d722e4d656f77” claimed to have leaked a CenterPoint database containing roughly 7.49 million raw JSON records and 6.73 million filtered CSV records, and provided sample data.
CenterPoint previously investigated a separate incident involving customer information stolen through a file-sharing platform.
CenterPoint reported the incident to law enforcement and engaged third-party experts to determine the affected customers and data. The company said electric and natural-gas delivery was not disrupted and that required notifications would be made.
CenterPoint disclosed in an SEC 8-K filing that attackers obtained customer personal information from an internet-facing system after the company became aware of a dark-web post offering purportedly stolen data. It did not confirm the claimed 7.5 million-record volume or precise data set.
Five proposed federal class-action lawsuits were filed over the alleged breach, including three brought by Shamis and Gentile and two by Lippe and Associates. The suits alleged inadequate security and sought damages related to identity-theft and fraud risks.
Subsequent lawsuits alleged that cybercriminals accessed CenterPoint customer names, contact and billing information, and Social Security-number data during an incident placed between August 17 and September 1. Three complaints alleged the online guest bill-pay feature was the access vector.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcetherecord.media
Open sourceteiss.co.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Capital Economics and People's Energy both suffered data breaches in December 2020 that later surfaced in breach disclosures, exposing large volumes of customer information. Capital Economics, an economic research firm, had about **263,000 customer records** compromised, including names, email addresses, physical addresses, phone numbers, job titles, and employer details. People's Energy, a UK power company, had nearly **7GB of data** exposed, affecting **359,000 unique email addresses** along with names, phone numbers, physical addresses, and dates of birth. The breach also exposed staff email addresses and **`bcrypt` password hashes**, although available reporting said no customer passwords were included in the leaked data.
Jun 29, 2026
National Public Data disclosed a security incident affecting a large repository of consumer background-check and people-search information, with exposed data reported to include highly sensitive personal identifiers such as **Social Security numbers**, names, mailing addresses, and other profile details. The company published a breach notice on its website, while an individual notification letter filed with the California Attorney General indicates affected residents were formally notified that their information may have been involved. The incident drew attention because the compromised records appear to involve data commonly used for identity verification and fraud, increasing the risk of **identity theft**, account takeover, and social-engineering abuse. The notification materials show the breach response included direct notice to impacted individuals and guidance on protective steps such as monitoring accounts and credit activity, underscoring the seriousness of the exposure for consumers whose records were held by the data broker.
Jul 12, 2026
London Hydro, a Canadian utility serving more than 160,000 customers, disclosed a security incident that may have exposed customer personal and account information. The potentially affected data includes names, home and service addresses, email addresses, phone numbers, account and billing numbers, pricing plans, contract start dates, and meter information. The company said banking details, payment card data, dates of birth, and government-issued identification numbers were not involved, and it has begun notifying affected individuals. The utility has not disclosed how the intrusion occurred, whether data was exfiltrated, how many customers were affected, or whether ransomware, extortion, third-party systems, or operational technology played a role. London Hydro warned that the exposed account details could make phishing, impersonation, and fraudulent billing scams more convincing, and advised customers to watch for suspicious communications, unexpected bills, unfamiliar account activity, and requests to change payment arrangements.
Jun 29, 2026