October 15, 2026 (public disclosure): CenterPoint Energy, electric and gas utility serving Texas, Indiana, Ohio, and Minnesota, disclosed a data breach affecting at least 1,062,060 Texas customers. A threat actor publicly posted the stolen dataset on the dark web, prompting the company to confirm the breach. Exposed data: customer names, home addresses, Social Security numbers, and driver's license numbers. Canonical: centerpoint-energy-breach2026. Source: SecurityWeek.
What happened
CenterPoint Energy became aware of the breach when a threat actor publicly posted customer data on the dark web. The company subsequently confirmed the breach and disclosed it to the Texas Attorney General on October 15, 2026. An earlier SEC filing (Form 8-K) had been filed on September 14, 2026, suggesting the company discovered the breach earlier but did not immediately disclose publicly. The company states that service operations were not affected and the breach did not impact operational systems.
Technical analysis
The specific attack vector has not been disclosed. However, the fact that attackers obtained customer PII including Social Security numbers and driver's license numbers suggests they accessed the customer database directly, not just a payment system or web portal. The threat actor's public posting of data on the dark web indicates the attacker either wanted to sell it or use it for extortion.
Data exposed: Customer names, home addresses, Social Security numbers (full), driver's license numbers. Scope uncertainty: The company states 1,062,060 Texas customers confirmed affected, but attackers claim 7.49 million total records stolen. The discrepancy suggests either the attacker overstated the breach or the company is reporting only confirmed cases.
CenterPoint serves millions of customers across four states (Texas, Indiana, Ohio, Minnesota), so the actual number could be much higher if other states' customers are included in the attacker's claim.
Impact
Scope: Confirmed 1,062,060 Texas customers. Potential 7.49 million total if attacker's claim is accurate (covering Texas, Indiana, Ohio, Minnesota service areas).
Risks: Identity theft (attackers have full SSN, driver's license number, name, and address), credit fraud (criminals can open accounts and take out loans), phishing (scammers can pose as utility customer service), and social engineering. SSN and driver's license number are particularly high-value for identity criminals. This data is saleable on the dark web and commonly used in large-scale fraud rings.
What to do
- Monitor credit reports: Request free annual credit reports from all three bureaus (Equifax, Experian, TransUnion). Watch for fraudulent accounts or inquiries.
- Place a fraud alert: Contact one credit bureau to place a fraud alert, which requires creditors to verify your identity before opening new accounts.
- Consider a credit freeze: Lock your credit with all three bureaus to prevent new accounts from being opened in your name. This is the strongest protection.
- Monitor utility account: Check your CenterPoint Energy bill regularly for unauthorized usage or account changes. Contact the utility directly to verify any service-related communications.
- Watch for phishing: Ignore unsolicited emails claiming to be from CenterPoint Energy. Call the utility directly using the number on your bill.
- Monitor SSN usage: Check IRS records for fraudulent tax filings (IRS.gov identity theft tools). Monitor for loans or accounts opened in your name.
Related reading
See utility breach response guide.