CenterPoint Energy has confirmed a CenterPoint Energy data breach in which an attacker obtained personal information belonging to an unspecified portion of its customers, after the threat actor went public with 7.49 million records allegedly pulled from the company’s own external-facing systems. The attacker’s account of how they did it makes uncomfortable reading for anyone responsible for API security.
How the CenterPoint Energy data breach unfolded
The attacker, operating under the alias “4d722e4d656f77”, told Help Net Security that the data was extracted by iterating through millions of IDs on CenterPoint’s public API. According to the threat actor, the API lacked rate limiting, web application firewall (WAF) protection, and other safeguards against automated access, the sort of basic controls that would ordinarily make bulk enumeration impractical.
The data was pulled in JSONL format, the attacker wrote, then filtered into CSV files with the personal information kept intact. The haul includes names, phone numbers, service and billing addresses, account numbers, billing amounts, and partial Social Security numbers (SSNs). That is a combination well-suited to identity fraud and phishing, since it blends contact details with enough financial and identity context to sound convincing.
The scale could have been considerably worse. A CAPTCHA cut the download short at 7.49 million lines; without it, the threat actor wrote, “we would have pulled 17.44 million data.” CenterPoint serves approximately 7 million metered customers across Indiana, Minnesota, Ohio, and Texas, which gives some sense of the potential ceiling.
The attacker claims they contacted CenterPoint before going public but that the company ignored their messages and treated them as a joke. Whether that account is accurate or self-serving is impossible to verify, but the decision to leak the data publicly followed shortly after.
What CenterPoint has disclosed, and what it has not
CenterPoint filed a Form 8-K with the U.S. Securities and Exchange Commission (SEC) on 14 September 2026, confirming that an unauthorised third party had obtained customer personal information through one of the company’s external-facing systems, according to SafeState. The filing stops well short of the detail the threat actor has already made public: it does not name the attacker, confirm the number of affected customers, or specify which categories of data were compromised.
“While the investigation remains ongoing, the Company has determined that an unauthorized third party obtained personal information relating to a portion of the Company’s customers through one of the Company’s external-facing systems,” the SEC filing reads. The company added that it “intends to notify affected customers and regulatory authorities as required by applicable law.”
CenterPoint has activated its incident-response procedures, engaged third-party cybersecurity experts, strengthened protections on its systems, and reported the incident to law enforcement and regulators. The company said its electric and gas services were not affected, and that it does not believe the incident will materially affect its business or financial condition.
The company is a Houston-based public utility providing electric and natural gas services and operating power generation facilities. It employs roughly 8,300 people and generates over $9.3 billion in annual revenue.
Lawsuits already in motion
Multiple law firms representing potentially affected customers have already filed proposed class-action lawsuits against CenterPoint in federal courts. The filings allege the CenterPoint Energy data breach occurred between 17 August and 1 September, a window that predates the company’s public disclosure by several weeks.
That gap between breach and disclosure is likely to feature prominently in the litigation. Class-action complaints in data breach cases typically argue that companies had both the means to detect intrusions sooner and an obligation to notify customers promptly, and here the attacker claims to have sent warnings that went unacknowledged.
The API enumeration technique the threat actor describes is far from novel, but cases of this scale are still relatively rare. The absence of rate limiting on a customer-facing API holding partial SSNs, billing data, and account numbers represents exactly the kind of misconfiguration that security reviews are supposed to catch. CenterPoint has not publicly addressed the specific API vulnerability, and its investigation remains ongoing. Affected customers will be notified as the scope of the incident is finalised.
