On October 13, 2026, a routine Texas attorney general filing gave the first hard numbers to a breach the internet already knew about. CenterPoint Energy reported 1,062,060 affected Texans and 1,611,625 affected individuals overall, with names, addresses, Social Security information, and driver's license numbers among the compromised data. The unauthorized access ran from August 19 through August 22. The company discovered it on September 9. The public found out on a cybercrime forum before any of that, and the gap between what the attacker claimed and what the company confirmed is the whole story of modern breach disclosure.
CenterPoint is a Houston-based electric and natural gas utility serving about 7 million customers across Texas, Indiana, Minnesota, and Ohio. It is the kind of company almost everyone in its territory is a customer of by default. That makes its customer database something close to a census of the region it serves.
The post came before the press release
The breach did not surface through a corporate announcement or a regulator. In September, a threat actor posting under the alias 4d722e4d656f77 put a 2.5 gigabyte archive up for download on a cybercrime forum and claimed it held roughly 7.49 million CenterPoint customer records. The person told BleepingComputer the data was pulled through a public-facing CenterPoint API with no rate limiting, no web application firewall, and no authentication token. None of that has been confirmed by the company, and it should be treated as an attacker's unverified claims, not established fact.
On September 14, CenterPoint filed a Form 8-K with the U.S. Securities and Exchange Commission that confirmed the essential shape of the incident. The company said it had become aware in September of an online post by a third party claiming to hold customer information, and that an unauthorized third party had obtained personal information relating to "a portion of the Company's customers" through one of its external facing systems. It said it had activated its incident response, brought in outside cybersecurity experts, reported the matter to law enforcement and regulators, and intended to notify customers as required by law. Electric and gas delivery were not disrupted, and the company said it did not expect a material financial impact.
The breach disclosure did not begin with a press release or a regulatory filing. It began with a stranger's forum post, and the company has been playing catch-up ever since.
The gap between 7.49 million and 1.6 million
Enjoying this story?
Get the five most important stories in tech, every morning. Free.
The difference between the attacker's claimed 7.49 million records and the confirmed 1.6 million affected individuals deserves careful reading. The 1,611,625 figure comes from the Texas attorney general's record, which lists 1,062,060 affected Texans plus additional individuals the company identified elsewhere. Texas requires reporting for breaches affecting at least 250 Texans, and the registry cautions that counts and notification status can change as companies submit updated information.
The confirmed numbers can still grow. Companies often revise their totals upward as forensic investigations progress, and CenterPoint said in September that it was still determining the scope of customers and data involved. Meanwhile the attacker's figure, however loudly advertised, remains a claim from someone with every incentive to exaggerate.
Why a utility's customer database is such a prize
CenterPoint Energy Breach, at a Glance
Confirmed figures sit well below the attacker's claimed haul.
Note: The 7.49M figure is the attacker's unverified claim; counts may be revised as the investigation continues.
A utility's customer records are different from a retailer's. Signing up for electricity usually requires identity verification good enough for credit checks, which is why driver's license numbers and Social Security fragments end up in the same database as billing addresses. Nearly every household in the service territory is enrolled, which makes the dataset a near-complete map of a region's residents, addresses, and billing histories.
That combination, name, address, phone, driver's license number, and a Social Security fragment, is the standard starter kit for identity theft and convincing phishing. An attacker does not need full Social Security numbers to run scams. Enough matching personal details lets a criminal impersonate the utility itself, calling customers about their "compromised account" with real account details to prove legitimacy.
The incident also illustrates a common architectural split. CenterPoint stressed that electricity and gas delivery remained uninterrupted, which is typical: the operational technology that runs the grid sits apart from the customer-facing IT systems that process bills and accounts. The breach targeted the customer side, not the power lines. That is small comfort to the people whose driver's license numbers are now in circulation.
The new disclosure playbook
This is becoming a pattern. Attackers increasingly publish their claims first, turning disclosure itself into a weapon: pressure the victim, demonstrate control of the data, and force a public investigation before the victim has finished its own. The tactic works whether the claimed numbers are accurate or inflated, because the company must still investigate the worst case in public view.
Companies now race on two tracks at once. On one, they investigate forensics: which systems, whose data, how much. On the other, they manage a disclosure that started without them. CenterPoint's September 8-K came within roughly a month of the attack and within days of the company learning of the forum post. The Texas filing added concrete counts about a month later. That is a normal cadence for a real investigation, and it still felt slow to everyone who had already seen the claims.
Regulators are building faster rails. The SEC's four-business-day incident disclosure rule for public companies exists precisely so investors learn about material incidents quickly, and Texas's 250-person reporting threshold is designed to surface breaches like this even when a company considers the financial impact immaterial. Multiple proposed class action lawsuits were already filed in federal court within days of the 8-K, which is now the standard aftermath for any breach of this size.
The practical takeaways are unglamorous but real. API rate limiting and web application firewalls are baseline hygiene, not advanced defenses, and a public-facing API that serves millions of customer records should have had both. Attack surfaces built for convenience, self-service portals, open APIs, partner integrations, keep becoming the entry point. And customers should assume that when their utility is breached, the details on their bill are details an attacker now owns too.
The count will likely be revised again. The class actions will grind forward. But the lasting lesson of the CenterPoint breach is procedural: in 2026, the first breach disclosure often does not come from the company. It comes from the forum, and the company spends the next month proving the forum wrong about the numbers while quietly confirming it was right about the breach.
0 Comments