CenterPoint Energy, the electric and gas provider for most Katy and Fulshear households, confirmed Monday, Sept. 14, that an unauthorized third party stole personal information belonging to some of its customers.
The Houston-based utility disclosed the breach in a Form 8-K filed with the U.S. Securities and Exchange Commission. CenterPoint said it learned in September of an online post claiming a third party had obtained a dataset of customer information. The company launched an investigation with outside cybersecurity experts and reported the incident to law enforcement.
CenterPoint has not said how many customers were affected, what types of personal data were taken, or when the breach occurred. A CenterPoint spokesperson told KPRC 2, "Our filing speaks for itself," giving the same response to multiple Houston television stations.
What the lawsuits allege
Five proposed class-action lawsuits had been filed in federal court as of Monday, Sept. 14, according to the Houston Chronicle. Three were brought by Florida law firm Shamis and Gentile on behalf of customers Laurie Eirwin, Latoya Wyche and Christa Floyd. Two were filed by Dallas firm Lippe and Associates on behalf of Joyce Curry and Nathaniel Sonia. The plaintiffs are residents of Indiana, Texas and Minnesota. No class has been certified.
The lawsuits place the breach between Aug. 17 and Sept. 1. Three of the suits allege CenterPoint's guest bill pay feature was the weak point. That online tool lets customers pay using only an account number but also retrieves personal information once the correct number is entered, the suits claim.
One lawsuit alleges roughly 7 million filtered records were leaked. Another puts the figure at approximately 6.7 million affected customers. CenterPoint has not confirmed either number.
Separately, cybersecurity outlet BleepingComputer reported that a threat actor claimed to have stolen 7.49 million records containing names, phone numbers, billing addresses, account numbers, billing amounts and partial Social Security numbers. CenterPoint has not confirmed those data types or the claimed record count.
What CenterPoint is doing
The company said it activated its cybersecurity incident response protocols and enlisted third-party experts. It reported the breach to law enforcement and said it notified "certain regulatory authorities" without specifying which ones. CenterPoint said its electric and gas services remain operational and that it does not expect a material financial impact. The company said it carries cybersecurity insurance it believes will offset related costs.
CenterPoint said it plans to notify affected customers as required by law. Under the Texas Identity Theft Enforcement and Protection Act, a business must notify affected Texas residents within 60 days of determining a breach occurred. If 250 or more Texans are affected, the company must also report to the Texas Attorney General within 30 days.
CenterPoint has not set up a dedicated breach notification page or hotline. Residents who want updates can check centerpointenergy.com or call the company's main customer service line.
CenterPoint serves roughly 7 million metered customers across Texas, Indiana, Minnesota and Ohio. The company has not said when it will begin notifying those affected by the breach.
