CenterPoint Energy tells Texas regulator over 1 million residents hit by customer data breach

TLDR

• CenterPoint Energy told Texas regulators that 1,062,060 Texas residents were affected by a data breach.¹
• Names, addresses, Social Security numbers and driver's licence numbers were compromised, data that supports identity fraud.¹²
• The total is unclear, as CenterPoint also serves customers in Indiana, Minnesota and Ohio.¹²

CenterPoint Energy notified Texan authorities this week that more than one million people had personal information compromised, one month after the Houston-based utility told the SEC that customer information had been stolen.¹ According to the Texas Attorney General's report as relayed by KHOU, the exposed data includes names, home addresses, Social Security numbers and driver's licence information, and says affected customers have not yet been notified.²

SecurityWeek reports that days before the SEC disclosure a hacker boasted on a cybercrime forum of having nearly 7.5 million user records from the utility, and that on 12 September the hacker made a 2.5 GB archive available that allegedly contains around 3 million phone numbers along with other personal information.¹ CenterPoint's SEC filing said it learned of the incident from the public post, that only a portion of its customers were affected, and that an unauthorised third party obtained personal information through an external-facing system.¹² The company has said it does not believe a material financial impact is reasonably likely.²

In a statement to KHOU, CenterPoint said it continues to investigate with external cybersecurity, forensic and legal advisers and is still working to determine which customers will be notified.² SecurityWeek said the total number affected remains unclear and that it had asked CenterPoint for clarification; the hacker's claimed 7.5 million records has not been confirmed by the company.¹ A class-action lawsuit over the incident was filed before the SEC filing, according to KHOU.²

Why it matters: CenterPoint has described the affected group only as a "portion" of its customers, while the Texas count alone is 1,062,060 and the hacker's claim of nearly 7.5 million records is unconfirmed. With customers in Indiana, Minnesota and Ohio also possibly affected, the final total is unclear, and names combined with Social Security and driver's licence numbers are the kind of data that supports identity fraud.¹²