CenterPoint confirms a customer data theft it learned about from a dark web post
CenterPoint Energy's 8-K says an unauthorized party took customer personal information through an external-facing system. The person selling the file says it came out of a public API with no rate limiting.
The Watch · Security desk
What happened
- CenterPoint Energy told the SEC that an unauthorized third party obtained personal information relating to a portion of its customers through one of the company's external-facing systems.
- The disclosure followed a September 12 post on a cybercrime forum by an actor using the alias 4d722e4d656f77, who claimed roughly 7.49 million CenterPoint customer records.
- The actor put a 2.5 GB archive of the claimed data up for download on the forum.
- The filing confirms the theft without naming the threat actor, the number of affected customers or the categories of data taken, and says electric and gas delivery was unaffected.
Why it matters
- Who's exposed exposure The claimed field set is enough to pass a call center script or send a bill that reconciles: name, service and billing address, account number, billing amount and the last digits of a Social Security number.
- What's now possible capability Enumeration of sequential IDs needs no exploit and no malware, so any self-service customer API without throttling is extractable with a script. Detection depends on traffic monitoring the actor says was absent here.
- What it costs cost Litigation and notification costs start before the victim list exists: outside counsel is already filing while outside forensics are still counting affected customers.
- What doesn't add up contradiction The only technical account of the vulnerable component comes from the person selling the data, and no outlet has validated the archive.
Next story · Security · 13h ago
CenterPoint Energy reports 1,062,060 Texans had Social Security and license numbers compromisedConfirmed2 publishers
The person selling the data describes enumeration, not intrusion. They told BleepingComputer the records came out by iterating through millions of IDs on CenterPoint's public API, which they said had no rate limiting, no web application firewall and no other controls against automated access [8]. On the forum the same actor wrote: "We obtained said data from an API they managed and controlled, which lacked proper WAF protection, rate limiting, certification protection, and no JWT/Auth token to pull said data." [10]
The utility has not corroborated any of that. A CenterPoint spokesperson declined to answer questions about the criminal post [6], and SecurityWeek said it could not confirm the validity of the archive [20]. The claimed fields are names, phone numbers, service and billing addresses, account numbers, billing amounts and partial Social Security numbers [5].
CenterPoint delivers electricity and gas to about 7 million metered customers in Indiana, Minnesota, Ohio and Texas [18]. The claim is 7.49 million lines at one user per line, roughly 490,000 more than the metered customer count, so the set is not one row per current account [23]. The actor also said the pull got capped part way through: "Mid the 7.49 million mark, they did an attempt to stop us dumping data, which, with a simple CAPTCHA key, in terms, we would have pulled 17.44 million data from said company." [11] By that count, 9.95 million records stayed behind whatever control got applied [25]. The post ends with a threat: "next time we won't simply pull data, we'll start attacking the main infrastructure" [16].
Proposed class actions filed in federal court allege the breach ran between August 17 and September 1 [14]. The forum post came on September 12, eleven days after the end of that alleged window [3][24]. The 8-K went in on Monday evening [1]. It opens by saying the company "became aware of an online post by a third party claiming to have obtained a data set containing certain of the Company's customer information" [9]. The actor told BleepingComputer that CenterPoint ignored their messages and treated them as a joke before the data was leaked [17].
CenterPoint has turned up in leak claims before. In 2024 it was one of several energy firms named by an access broker calling itself AntiBrok3rs, and a separate actor later claimed to hold company data. Both sets were believed to have come from Cl0p's 2023 MOVEit campaign and from a third party, not from CenterPoint's own systems [15]. This filing points at one of the company's own external-facing systems [2].
The company said electric and gas delivery was not affected and that it does not believe the incident will materially affect its business or financial condition [12]. It reported net income of $244 million in the second quarter [19] and said it will incur costs from the investigation [13]. It has activated incident response, hired third-party cybersecurity experts, strengthened protections on its systems and reported the incident to law enforcement and regulators [21]. On scope, the filing says CenterPoint "is continuing to work with third-party experts to determine the scope of customers and personal information affected by the incident and intends to notify affected customers and regulatory authorities as required by applicable law" [22].
What to watch
- Whether CenterPoint's customer notification letters and state regulator filings put a number anywhere near 7.49 million.
- Whether an amended 8-K names the external-facing system and the data categories after the third-party review closes.
- Whether anyone independently validates the 2.5 GB archive against CenterPoint account records.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+20
- Incentives65
- Confidence60
Perspective Coverage
6 publishers- Builder
- Builder 25%
- Operator
- Operator 54%
- Investor
- Investor 21%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
CenterPoint Energy filed an 8-K form with the SEC on Monday evening confirming it became aware of a dark web post this month claiming to offer data stolen from the company.
- [2]
The SEC filing states: "While the investigation remains ongoing, the Company has determined that an unauthorized third party obtained personal information relating to a portion of the Company's customers through one of the Company's external-facing systems."
- [3]
On September 12 a threat actor using the alias "4d722e4d656f77" claimed on a cybercrime forum to have extracted roughly 7.49 million customer records from CenterPoint Energy.
- [4]
In the SEC filing CenterPoint Energy confirms data was stolen but does not name the threat actor, the number of affected customers, or the types of compromised data.
- [5]
The threat actor said the stolen 7.49 million customer records include names, phone numbers, service and billing addresses, account numbers, billing amounts, and partial Social Security numbers.
- [6]
A spokesperson for CenterPoint Energy declined to answer other questions about the cybercriminal post.
- [7]
The threat actor made available for download a 2.5 GB archive file allegedly containing data stolen from CenterPoint Energy.
- [8]
According to the intruder, they exfiltrated the data by iterating through millions of IDs on CenterPoint's public API, which lacked rate limiting, web application firewall protection, and other security measures against automated access.
- [9]
The 8-K report states: "In September 2026, CenterPoint Energy, Inc. (the "Company") became aware of an online post by a third party claiming to have obtained a data set containing certain of the Company's customer information."
- [10]
The hacker wrote in the forum post: "We obtained said data from an API they managed and controlled, which lacked proper WAF protection, rate limiting, certification protection, and no JWT/Auth token to pull said data."
- [11]
The hacker wrote in the forum post: "Mid the 7.49 million mark, they did an attempt to stop us dumping data, which, with a simple CAPTCHA key, in terms, we would have pulled 17.44 million data from said company."
- [12]
CenterPoint Energy said its electric and gas services were not impacted by the cyberattack and does not believe the incident will materially affect its business or financial condition.
- [13]
The filing says CenterPoint Energy will incur some costs related to the investigation but the incident is not likely to have a material impact on the company's finances.
- [14]
Multiple proposed class action lawsuits have already been filed in federal courts by law firms representing potentially impacted customers, alleging the data breach occurred between August 17 and September 1.
- [15]
In 2024 CenterPoint Energy was one of several energy companies targeted by an access broker named AntiBrok3rs, and a few months later a different hacker claimed to have obtained the company's data; in both cases the stolen data was believed to have come from the Cl0p ransomware group's 2023 MOVEit campaign, and analysts believed the CenterPoint data originated from a third party rather than directly from the company's systems.
- [16]
The hacker threatened that "next time we won't simply pull data, we'll start attacking the main infrastructure".
- [17]
The threat actor leaked the data, claiming that the company ignored their messages and treated them as a joke.
- [18]
CenterPoint Energy serves approximately 7 million metered customers across Indiana, Minnesota, Ohio and Texas, employs roughly 8,300 people and generates over $9.3 billion in annual revenue.
- [19]
CenterPoint Energy reported net income of $244 million in the second quarter.
- [20]
SecurityWeek said it cannot confirm the validity of the data and noted it is not uncommon for hackers to make false or exaggerated claims.
- [21]
CenterPoint has activated its incident-response procedures, hired third-party cybersecurity experts, strengthened protections on its systems, and reported the incident to law enforcement and regulators.
- [22]
The filing states: "The Company is continuing to work with third-party experts to determine the scope of customers and personal information affected by the incident and intends to notify affected customers and regulatory authorities as required by applicable law."
- [23]
The claimed 7.49 million lines exceed CenterPoint's approximately 7 million metered customers by roughly 490,000, so the claimed data set is not one row per current metered account.
- [24]
The September 12 forum post came 11 days after September 1, the end of the exfiltration window alleged in the proposed class actions.
- [25]
By the actor's own figures, 9.95 million records were left unextracted after the mid-dump intervention.
Sources
6 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comCenterPoint Energy confirms customer data stolen in cyberattack
1 article · September 15, 2026
- helpnetsecurity.comCenterPoint Energy confirms data breach following claims on hacking forum
1 article · September 16, 2026
- securityaffairs.comTexas Utility CenterPoint Energy Confirms Data Breach After Hacker Claims 7.49M Records Stolen
1 article · September 16, 2026
- securityweek.comTexas Utility CenterPoint Energy Confirms Breach After Hacker Leaks Data
1 article · September 15, 2026
- thecyberexpress.comCenterPoint Energy Tells SEC Customer Data Was Stolen After 7.5Mn Records Advertised Online
1 article · September 16, 2026
- therecord.mediaElectric and gas utility CenterPoint Energy warns of data breach after dark web post
1 article · September 15, 2026
Topics and entities
Topics
- SEC cyber incident disclosure
- Utility cybersecurity
- Data Breaches
- API Security
Entities
- MOVEit Transfer
- CenterPoint Energy
- Cl0p
- U.S. Securities and Exchange Commission