What Happened
CenterPoint Energy, the Houston-based utility, has notified the Texas Attorney General’s Office that the personal information of 1,062,060 Texans was compromised in a data breach. According to the filing, the compromised information includes names, addresses, Social Security numbers and driver’s license numbers.
The timeline matters. On a known cybercrime forum, a hacker claimed to have nearly 7.5 million CenterPoint user records. Days later, CenterPoint disclosed the breach to the SEC, and the company confirmed it learned of the breach after the attacker’s public post. In its filing, CenterPoint said an unauthorized third party obtained personal information relating to a portion of the company’s customers through one of its external facing systems. The company has not said more about how the attacker got in. (Article link: securityweek)
On September 12, the attacker made a 2.5-gigabyte archive available for download that it says contains data taken from the utility. The file appears to include about 3 million phone numbers along with other personal information.
CenterPoint says the incident has not affected the delivery of electric and gas services. The company also serves customers in Indiana, Minnesota and Ohio, and residents of those states may have been affected as well. The full scope has not been confirmed. Based on this week’s filing, it appears notification letters have not yet gone out to affected Texans.
Why this matters to business leaders
The attacker set the timeline. The most important fact in this story isn’t the number of records. It’s how the company found out. When a breach comes to light through an attacker’s public post, the attacker decides when the story breaks and what the public hears first, and the company starts its response from behind.
This also isn’t the first time CenterPoint customer data has turned up on a criminal forum. In December 2024, a hacker claimed to have a database of CenterPoint customer information taken in a 2023 breach. At that time, the company said it believed the data was obtained from a third-party vendor’s system and had no reason to believe its own network was compromised. These were separate incidents, but they point to the same question for any leadership team: if our data were taken tonight, would we know before someone posted about it? (Info: therecord)
“How many people?” is the hardest question to answer. The attacker claimed nearly 7.5 million records. The confirmed figure for Texas is just over 1 million. The numbers for other states are unclear. Gaps like this are common, and they are costly. Regulators, customers, boards and reporters all want a number, and you can’t give a reliable one unless you know where your sensitive data lives, who can reach it, and what happened to it.
No operational impact isn’t the same as no impact. In the energy sector, security conversations often focus on OT, the technology that runs physical equipment like wells, pipelines and compressors. That focus is right. But this incident is a reminder that the business side of an energy company is also a target. Stolen customer and identity records don’t shut down a pipeline, but they bring legal exposure, regulatory scrutiny and reputational damage that can outlast an outage.
Social Security and license numbers don’t expire. A stolen password can be changed. A Social Security number can’t. That makes this data valuable for fraud, impersonation and convincing phishing for years. Some of the people affected may be your employees, executives or vendors. Expect attackers to use real personal details to make fake calls and emails look legitimate.
What to ask your team
How would we know? Ask what would alert you to a breach before an outsider did. Listen for: specific ways you’d detect it, such as alerts when large amounts of data leave your systems, someone watching those alerts around the clock, and monitoring of criminal forums for your company’s data. Red flag: “We’d probably hear about it,” or an answer that depends on a customer or reporter calling you.
Where does our most sensitive data live? Customer records, employee files, Social Security numbers, license data. Listen for: a named list of systems, who has access to each, and when that access was last reviewed. Red flag: “It’s mostly in our main system,” or a pause followed by “we’d have to look.”
Could we answer “how many” within days?If a regulator asked tomorrow how many people were affected, could you give a number you’d stand behind? Listen for: records of who accessed what and when, kept long enough to look back weeks or months. Red flag: “We’d need to bring in outside help to figure that out,” with no records to give them.
Is our notification plan ready? Texas and other states have breach notification requirements. Listen for: named people for each role, legal counsel already identified, and a plan that’s been practiced recently. Red flag: a document nobody has opened since it was written, or “legal would handle that.”
Are our people prepared for what comes next? When personal data leaks at this scale, targeted phishing follows. Listen for: a clear way for employees to verify requests, such as calling back a known number before acting on anything involving money or access. Red flag: training that’s only an annual video, or no process for confirming who’s really calling.
The Bottom Line
This breach didn’t stop the lights or the gas. It exposed information that can’t be reset, and the company learned about it after the attacker went public. For leadership teams in Texas energy and beyond, the lesson isn’t about one utility. It’s about whether you would see a breach first, and whether you could answer the hard questions quickly once you did.
Sources: SecurityWeek, “CenterPoint Energy Data Breach Impacts 1 Million Texans,” October 15, 2026; SecurityWeek, “Texas Utility CenterPoint Energy Confirms Breach After Hacker Leaks Data”; The Record by Recorded Future News, “Texas utility firm investigating potential leak of customer data tied to 2023 MOVEit breach.”