Organization

CenterPoint Energy

2 mentions in 7 days · 2 in 30 days · 2 total · first seen Sep 16, 2026 · last 1d ago

Timeline2 articles

CenterPoint Energy confirms data breach following claims on hacking forum

CenterPoint Energy confirmed a breach after a hacker claimed stealing 7.49 million customer records via an unauthenticated API lacking WAF, rate limiting, and token checks.

CenterPoint Energy, a Houston-based utility serving about 7 million customers, confirmed in a September 14 SEC Form 8-K that an unauthorized third party accessed customer data through an external system after a hacker posted a 7.49 million-line dataset online. The exposed fields include names, phone numbers, addresses, account numbers, emails, driver's license numbers, and the last four digits of Social Security numbers. The hacker said the API had no web application firewall, rate limiting, certificate checks, or authentication token, and that a CAPTCHA stopped exfiltration at 7.49 million of a claimed 17.44 million lines. The company faces multiple class action lawsuits and is working with outside experts to determine scope.

Help Net Securityupdated Sep 16, 15:32 UTC · 22h agofirst Sep 16, 10:35 UTC · 1d agoData breach in the wild 5 sources

Texas Utility CenterPoint Energy Confirms Data Breach After Hacker Claims 7.49M Records Stolen

CenterPoint Energy confirmed a breach after a hacker claimed stealing 7.49 million customer records, including partial Social Security numbers, via an unprotected API.

CenterPoint Energy disclosed in an SEC 8-K filing that an unauthorized third party obtained personal information of a portion of its customers through an external-facing system. A threat actor using the alias '4d722e4d656f77' claimed on a cybercrime forum to have extracted over 7.49 million records, including names, addresses, account numbers, billing data, and partial Social Security numbers, via an API lacking authentication, rate limiting, and WAF protection. The company confirmed the breach but not the record count; energy services were unaffected and the investigation is ongoing.

Security Affairsupdated Sep 16, 15:32 UTC · 22h agofirst Sep 16, 08:19 UTC · 1d agoData breach in the wild 5 sources

Appears with

threat actor 4d722e4d656f77 2 victim CenterPoint Energy 2 organization SEC 1 vendor CenterPoint Energy 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.