Texas Utility CenterPoint Energy Confirms Data Breach After Hacker Claims 7.49M Records Stolen
CenterPoint Energy confirmed a breach after a hacker claimed stealing 7.49 million customer records, including partial Social Security numbers, via an unprotected API.
CenterPoint Energy disclosed in an SEC 8-K filing that an unauthorized third party obtained personal information of a portion of its customers through an external-facing system. A threat actor using the alias '4d722e4d656f77' claimed on a cybercrime forum to have extracted over 7.49 million records, including names, addresses, account numbers, billing data, and partial Social Security numbers, via an API lacking authentication, rate limiting, and WAF protection. The company confirmed the breach but not the record count; energy services were unaffected and the investigation is ongoing.
- Hacker alias 4d722e4d656f77 advertised a 2.5 GB archive and claims 17.44 million records were accessible.
- Claimed stolen fields include names, addresses, account numbers, billing amounts, and partial SSNs.
- Attacker said the API lacked WAF, rate limiting, and JWT authentication; services unaffected.
- Company will notify customers and regulators; phishing and credential-stuffing risk expected.
- Threat actors
- 4d722e4d656f77
- Victims
- CenterPoint Energy
- Organizations
- CenterPoint Energy
- Countries
- United States
From the original article
3 min read at securityaffairs.com
CenterPoint Energy confirmed a customer data breach after a hacker claimed to leak 7. 49M records, including personal and billing information. CenterPoint Energy admitted on Monday that an intruder stole personal information belonging to some of its customers.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.