CenterPoint Energy told regulators on September 14, 2026, that an unauthorized third party obtained customer personal information through an external-facing company system—turning weeks of hacker forum bragging into a verified CenterPoint Energy data breach disclosure even while the headcount and exact data types remain under investigation. Electric and gas delivery continued; the damage is identity and account data, not grid control.
The admission arrived in a Form 8-K filed with the U.S. Securities and Exchange Commission, the kind of material event notice investors expect when cyber incidents may trigger notification costs, litigation, or reputational harm. Reuters and trade press including BleepingComputer covered the filing the same week. CenterPoint said it learned of an online post claiming a customer dataset, investigated, and concluded that personal information relating to a portion of customers had been taken via the external system.
That is company-attested theft. It is not yet a company-attested census. CenterPoint had not published how many customers were affected when BreachHistory indexed the row; recordsAffected remains zero in the catalog until an official count lands. Separately, a threat actor calling itself “4d722e4d656f77” claimed roughly 7.49 million records exfiltrated through weakly protected API enumeration—field lists and volume that CenterPoint has not confirmed. Treat the 7.49 million figure as an unverified actor claim sitting beside a verified breach fact.
The canonical BreachHistory record is /centerpoint-energy/centerpoint-energy-api2026.
Timeline from August discovery to the September SEC filing
Public sources describe a gap between when access may have started and when investors received the 8-K. Understanding that window helps customers judge phishing risk and lawyers frame class-action allegations—without substituting court filings for the company’s own scope review.
- August 17, 2026 — CenterPoint’s catalog date marks when unauthorized access to customer personal information through the external-facing system is tied in litigation reporting and trade press summaries of the incident (class-action complaints allege an access window beginning around this date).
- Late August through early September — Online posts attributed to the threat actor 4d722e4d656f77 circulate, claiming a large customer dump obtained via API ID enumeration without adequate rate limits or web application firewall protections, according to BleepingComputer and Cyberinsider reporting on the hacker narrative—not on CenterPoint letterhead.
- September 1, 2026 — Class-action reporting cites an alleged end of the access window on or about this date; the company’s public 8-K text focuses on confirming unauthorized acquisition rather than publishing exact start/stop timestamps.
- September 14, 2026 — CenterPoint files the Form 8-K confirming that personal information relating to a portion of customers was obtained by an unauthorized third party through an external-facing system. Customer notifications were pending while scope was finalized, per the filing summary reported by Reuters.
What remains unknown at indexing includes the complete list of compromised data elements the company will put in state breach notices, whether full Social Security numbers were exposed or only last-four as the actor claimed, whether commercial gas accounts differ from residential, and whether the external system was customer-facing APIs, partner integrations, or another edge service. CenterPoint stated types were still under investigation in the material summarized by press coverage of the 8-K.
What CenterPoint confirmed vs what the hacker claimed
Company-attested facts
CenterPoint confirmed unauthorized acquisition of personal information for a portion of customers via an external-facing system. It confirmed delivery operations were not the target of the disclosure’s operational impact language—investor-facing cyber material emphasized customer data, not outages. It confirmed notifications would follow as scope is finalized, implying regulated breach-letter workflows likely underway across Texas and other states where CenterPoint serves millions of meters.
Actor-attested claims (unverified census and fields)
Reporting on the hacker post described alleged fields including customer names, phone numbers, email addresses, service and billing addresses, utility account numbers, billing amounts, payment and autopay-related fields, and last-four Social Security numbers. The actor asserted about 7.49 million records. None of that inventory is stamped as complete or accurate in the SEC filing described by Reuters and BleepingComputer.
API enumeration as a root cause appears in trade press as the actor’s technical story—unauthenticated or weakly protected identifiers allowing bulk scraping— not as a CenterPoint engineering post-mortem. If the company later confirms an API abuse pattern, expect recommendations around rate limiting, authentication, and WAF rules to appear in hardening statements; until then, describe API enumeration as alleged.
What was not exposed (per public statements at filing time)
CenterPoint’s September disclosure framing, as relayed by major outlets, did not describe ransomware-driven grid shutdowns or loss of gas pressure management systems. Customers were not told to prepare for multi-day outages caused by this cyber event. That distinction matters for Houston-area residents who associate CenterPoint with storm recovery and physical infrastructure: this incident is a customer-data theft track, not a SCADA catastrophe in the public record.
The company also had not affirmed the actor’s 7.49 million row count. “A portion of customers” can be thousands or millions; only future notices will narrow it. Last-four SSN exposure is particularly sensitive for utility phishing because many people treat utility bills as trusted documents—yet full SSN compromise, if any, would trigger stronger credit-freeze guidance than last-four alone.
Who is at risk
Residential electric and gas customers
If you receive power or gas under CenterPoint’s territory in the Greater Houston area and surrounding Texas markets, you are in the population the company said was impacted at some scale. Even before letters arrive, assume fraudsters may combine any leaked billing address and account number with public records to craft convincing bill scams.
Landlords and tenants in bundled-billing situations
Utility data often mixes service address with billing contact when renters pay through landlords or property managers. Notices may go to multiple parties; watch for forwarded phishing that references a service address you recognize but an email sender you do not.
Autopay and card-on-file users
Actor claims included payment and autopay fields. CenterPoint has not confirmed those categories. If they appear in final notices, prioritize monitoring bank debits and replacing cards stored for autopay—not because grid payment systems were hacked, but because social engineers use partial payment metadata to sound authentic.
Investors and employees
The 8-K pathway signals materiality to shareholders. Employees may face internal phishing using leaked customer service scripts if call-center tools were reachable from the same external footprint—speculative until scope details leak in notices. HR and IT should warn staff not to discuss customer data in unsolicited “breach war room” Zoom links.
Utility-sector context in Texas
Large Texas investor-owned utilities hold decades of billing history, move-in/move-out records, and identity fragments for credit checks. They are high-value targets for bulk PII because trust in the utility brand is high and seasonal bill spikes make payment lures believable.
2026 already saw other high-volume customer-data incidents in BreachHistory’s catalog—travel, airports, identity-scanning vendors—where external-facing APIs or third-party databases amplified exposure. CenterPoint joins that pattern on the verified side: confirmed exfiltration, external system, census pending. Readers comparing incidents should note CenterPoint’s dual-track story: SEC-confirmed breach plus unverified millions count from a forum persona.
Texas breach-notification law will drive letter content and timing once scope is final. Multi-state customers who formerly lived in CenterPoint territory should not ignore mail forwarded from old addresses.
How the attack may have worked (alleged vs confirmed)
CenterPoint attributed the incident in regulatory language to an unauthorized third party using an external-facing system. That phrasing often covers customer portals, mobile app backends, chatbot integrations, or partner APIs—without naming which.
BleepingComputer’s coverage of the hacker narrative described enumeration against API identifiers without meaningful throttling— a common failure mode when internal sequential account IDs meet public endpoints. If true, attackers could harvest rows at machine speed while appearing as normal traffic until someone correlates volume anomalies.
Defenders reviewing their own programs should not treat CenterPoint’s unnamed system as a checklist item to panic about; use the story as a reminder that utility customer APIs are part of attack surface, not just OT networks. Zero trust for machine clients, per-customer auth, anomaly detection on download rates, and WAF rules on enumeration patterns are standard mitigations—whether or not they failed here in the way the actor described.
Phishing and fraud scenarios specific to CenterPoint customers
Utility scams spike after real disclosures because criminals know customers expect billing email and SMS during hot Texas summers when air-conditioning load drives higher bills.
Fake overdue bill: “CenterPoint Energy: Disconnect in 24 hours unless you pay $214.37.” The amount may match a leaked billing amount field if actor claims are accurate. Real disconnection processes involve regulated notices and known payment channels— not Zelle to an individual.
Autopay “verification”: A message claims autopay failed and asks you to re-enter card and SSN last-four. CenterPoint’s legitimate flows live on authenticated web sessions; do not type SSN fragments into a form linked from email.
Account number plus address spear phish: “Confirm meter swap at [your service address]—sign here.” Attackers use leaked account numbers to pass first-line customer service scripts in vishing calls. Hang up and dial the number on your printed bill.
SEC / shareholder lures aimed at customers: “Class action—claim $500 compensation now.” Some will be legitimate law firms; many will be credential harvesters. Verify attorney identity through state bar sites before submitting ID scans.
Energy-efficiency rebate fraud: Unrelated to the breach mechanics but common in Houston— “CenterPoint rebate deposit—confirm bank routing.” Rebates have official program pages; do not trust cold calls after any breach news cycle.
What CenterPoint said about operations and notifications
Public summaries of the 8-K emphasize that electric and gas delivery services were not disrupted by the cyber incident as described to investors. Customer notifications were pending while the company finalized scope—standard language when forensic teams are still counting rows or deduplicating accounts shared by household members.
Reuters framed the disclosure under legal/litigation coverage, signaling expected follow-on suits. Class-action complaints alleging an August 17 through September 1 access window appear in trade press; those are attorney theories until discovery proves timelines. Customers should rely on CenterPoint’s official breach microsite or letter for legally binding descriptions of their own data.
What you should do if you are a CenterPoint customer
- Watch for official mail and email from CenterPoint describing whether your account is in scope and which data categories were involved. Save the letter; scammers copy its layout.
- Access your account only via bookmarked URLs or the official app—never through links in unexpected SMS about “disconnection” or “refund.”
- Place a fraud alert or freeze with U.S. credit bureaus if notices mention SSN components or if you supplied SSN for utility credit checks—last-four exposure still supports targeted identity theft when combined with other leaks.
- Monitor bank and card statements tied to autopay, especially if final notices confirm payment metadata exposure.
- Enable multi-factor authentication everywhere it is available outside SMS if you reused passwords between your utility portal and email.
- Report impersonation to CenterPoint customer service and Texas Attorney General consumer protection channels if you receive demonstrably fraudulent bill messages.
- Do not treat the 7.49 million figure as your personal answer key—wait for the company census; partial population wording in the SEC filing is deliberate.
- Document calls if you dispute fraudulent account changes using leaked account numbers; utilities can flag accounts for extra verification when customers report spear phishing.
Legal and regulatory threads to watch
SEC disclosure satisfies one audience; state AG notifications satisfy another. Texas residents should expect staggered notices if subpopulations differ in sensitivity (SSN fragments vs contact info only). Multi-state former customers may receive letters late.
Litigation may accelerate settlement marketing. Separate genuine legal notices from phishing by checking docket numbers on federal court sites rather than PDF attachments in email.
Searching “was I affected” and “CenterPoint breach 2026”
Until CenterPoint publishes a lookup tool or letter, “was I affected” searches will hit news aggregators and scam pages. Use centerpointenergy.com official paths only. If HIBP or state AG portals later list verified email domains, that supplements but does not replace utility letters for account-specific fields like service address and account number.
Keywords like utility customer PII, Texas data breach 2026, and last-4 SSN exposed map to different remediation steps. Match your actions to the categories in your eventual notice, not to the hacker’s maximal list.
Canonical record and authoritative sources
BreachHistory entry: 2026 CenterPoint Energy — SEC confirms customer PII via external system; actor claims ~7.49M (unverified count).
External references used in this article:
- BleepingComputer — CenterPoint Energy confirms customer data stolen
- Cyberinsider — CenterPoint confirms data breach after hacker claims 7.49M records
- Reuters — CenterPoint Energy discloses customer data breach in SEC filing
The verified core is simple: customer personal information left CenterPoint via an external-facing system, and the company is still finalizing how many people and which fields. The unverified layer is the forum million-row headline and detailed column list from 4d722e4d656f77. Hold both truths at once when you read the next headline about the CenterPoint breach 2026.
Credit monitoring, identity services, and realistic expectations
Large U.S. utilities often contract with credit-monitoring vendors after confirmed PII theft, but CenterPoint had not advertised a specific vendor package in the sources summarized here at indexing—only that customer communications were pending. When offers arrive, enroll through URLs printed on your official letter, not through QR codes on social media screenshots.
Monitoring detects new credit applications; it does not stop utility impersonation or account takeover on the billing portal if passwords were reused elsewhere. Pair monitoring with freezes if your notice mentions SSN components. Houston’s diverse renter population should note that monitoring letters may go to whichever name was on the account when data was copied—former roommates who remain on old leases should update forwarding addresses with the post office.
Why external-facing systems keep appearing in 2026 disclosures
Customer self-service, outage maps, payment kiosks, and partner telemetry all push data outside the traditional “corporate LAN.” Security teams classify these as external-facing because they touch the public internet or partner VPNs. Attackers hunt for objects that return customer rows when fed predictable IDs—a pattern alleged here but not yet forensically detailed by CenterPoint in public.
Investor-owned utilities also face quarterly reporting pressure, which is why the SEC 8-K landed before every state AG supplement was ready. That sequencing is normal: markets get early confirmation of material cyber risk; consumers get granular categories later. Do not interpret the gap as proof you are unaffected; interpret it as forensic work still running.
Comparing actor hype to prior utility incidents
Earlier verified utility rows in public breach catalogs sometimes started with anonymous million-record posts and ended with smaller attested counts after deduplication. Other times companies confirmed large populations. CenterPoint’s “portion of customers” language deliberately avoids both outcomes until data science finishes. Journalists should report the 7.49 million claim with the same skepticism applied to any forum census while still treating the SEC theft confirmation as ground truth for “data left the building.”