More than one million CenterPoint customers across Texas had their names, addresses, Social Security numbers and driver's license numbers exposed in a September data breach. The company still has not contacted those customers, according to a report filed with the Texas Attorney General's Office.

Katy falls within CenterPoint's electric delivery territory, which spans Fort Bend, Harris and Waller counties, meaning local households are among those potentially affected.

No one has been told.

As we reported Wednesday, Oct. 14, the scope of the breach became public through CenterPoint's filing with Attorney General Ken Paxton's office. ABC13 reported that the AG filing showed more than one million customers were affected and that CenterPoint had not yet reached out to any of them.

CenterPoint said in a statement Wednesday, Oct. 14, that it is still working with outside experts "to assess the scope of affected customer data to identify which customers will be provided notifications in accordance with applicable legal requirements."

The company said electric and natural gas service has not been disrupted.

How the breach happened

CenterPoint disclosed the incident in a Securities and Exchange Commission (SEC) filing on Sept. 14, days after a class-action lawsuit was filed against the company. According to that filing, the company learned of the breach after a third party claimed online to have obtained CenterPoint customer data. The company determined that an unauthorized party accessed personal information through one of its external-facing systems.

KHOU reported that cybersecurity expert David Taxer of Texas Cyber Solutions warned that even limited account information could let scammers impersonate CenterPoint in phone calls.

"What I would be most concerned about now is scammers calling people up, impersonating CenterPoint Energy, having information like their account number, one of their recent power bill amounts," Taxer told KHOU in a September interview.

Five customers across multiple states filed proposed class-action lawsuits against CenterPoint in the Southern District of Texas in September, according to the Houston Chronicle. Three of those lawsuits allege the company's guest bill-pay feature was the weak link that allowed unauthorized access.

Under Texas law, businesses that experience a breach affecting 250 or more residents must report it to the Attorney General's Office within 30 days and must also notify affected consumers, according to the AG's data breach reporting page.

What Katy and Fulshear residents can do now

Because CenterPoint has not sent individual notifications, residents who want to protect themselves should not wait. The Texas Attorney General's Office offers consumer protection guidance for potential identity theft victims. Steps residents can take include:

  • Placing a fraud alert or credit freeze with the three major credit bureaus: Equifax, Experian and TransUnion.
  • Monitoring bank and credit card statements for unfamiliar charges.
  • Being cautious of unexpected calls, emails or texts from anyone claiming to represent CenterPoint and asking for payment or personal information. Taxer specifically warned about scammers using stolen account details to sound legitimate.

CenterPoint said it expects cybersecurity insurance to offset costs related to the breach and its response.