CenterPoint Energy has confirmed that a cyberattack resulted in the theft of customer personal information from its systems. The disclosure came after a threat actor posted stolen data online and contacted BleepingComputer with details of the intrusion.
The Houston-based utility operates electric and natural gas infrastructure serving roughly 7 million metered customers across Indiana, Minnesota, Ohio, and Texas. The company employs approximately 8,300 people and generates annual revenue exceeding $9.3 billion.
An attacker using the handle "4d722e4d656f77" claimed responsibility for extracting 7.49 million customer records from CenterPoint's systems. The stolen data included names, phone numbers, service and billing addresses, account numbers, billing amounts, and partial Social Security numbers.
According to the intruder's account, the data was obtained by iterating through millions of identification numbers on CenterPoint's publicly accessible API. The attacker stated that the endpoint lacked rate limiting, web application firewall protection, and other defenses against automated access.
The threat actor told BleepingComputer that CenterPoint ignored their communications and dismissed them as a joke, leading to the decision to leak the data publicly.
In a filing submitted to the U.S. Securities and Exchange Commission, CenterPoint Energy acknowledged that an unauthorized party accessed personal information through one of its external-facing systems. However, the company did not disclose the threat actor's identity, the precise number of affected customers, or the specific categories of compromised data in the SEC filing.
While the investigation remains ongoing, the Company has determined that an unauthorized third party obtained personal information relating to a portion of the Company's customers through one of the Company's external-facing systems.
CenterPoint Energy SEC filing
The company stated it is continuing to work with third-party cybersecurity specialists to determine the full scope of the breach and plans to notify affected customers and regulatory authorities as mandated by law.
CenterPoint Energy emphasized that its electric and gas service delivery operations were not disrupted by the attack and does not anticipate material impacts to its business or financial performance.
The utility has implemented incident-response procedures, engaged external cybersecurity experts, enhanced system protections, and notified law enforcement and regulatory bodies about the breach.
Multiple class-action lawsuits have already been filed in federal courts by law firms acting on behalf of potentially affected customers. The legal filings allege that the data breach occurred between August 17 and September 1.