A data breach at CenterPoint Energy exposed the personal information of more than 1 million Texans, the Texas Attorney General's Office reported.

The compromised data includes names, addresses, Social Security information and driver's license numbers. The state's data breach database lists 1,062,060 affected Texans, KPRC 2 first reported. CenterPoint delivers electricity and natural gas across the Houston area, including Katy and Fulshear.

Affected customers had not been notified as of the state's data breach database entry, which was published on Attorney General Ken Paxton's website on Oct. 13. The state noted the number of affected Texans and the notification status may be updated later.

CenterPoint first disclosed the incident in a Sept. 14 filing with the U.S. Securities and Exchange Commission. In that filing, the company said it learned of an online post by a third party claiming to have obtained a dataset of customer information. CenterPoint did not reveal at that time how many customers were affected or what types of data were compromised.

A CenterPoint spokesperson said in a statement to KPRC 2 that the company "continues to actively investigate the cybersecurity incident disclosed last month."

The company said its electric and gas delivery services have not been disrupted.

How the breach allegedly happened

The breach allegedly occurred between Aug. 17 and Sept. 1, according to class-action lawsuits filed in federal court. A hacker posted data allegedly stolen from CenterPoint's systems on a cybercrime forum on Sept. 12, SecurityWeek reported.

Three of the lawsuits, filed by Florida law firm Shamis and Gentile on behalf of customers Laurie Eirwin, Latoya Wyche and Christa Floyd, allege the company's guest bill pay feature was the weak link, the Houston Chronicle reported. That feature allows customers to pay using an account number but also retrieves personal information when the correct number is entered, according to the lawsuits.

Two additional lawsuits were filed by Dallas law firm Lippe and Associates on behalf of customers Joyce Curry and Nathaniel Sonia. The five plaintiffs are from Indiana, Texas and Minnesota, the Chronicle reported. The lawsuits allege CenterPoint failed to use appropriate security measures to prevent the breach.

CenterPoint has not publicly responded to the lawsuit allegations.

What Katy-area residents should know

Texas law requires companies to notify affected consumers no later than 60 days after determining a breach occurred. Companies must also report breaches affecting at least 250 Texans to the attorney general within 30 days.

The investigation remains ongoing. CenterPoint said it has hired cybersecurity, forensic and legal advisers and reported the matter to law enforcement, according to its SEC filing. The company said it maintains cybersecurity insurance to offset related costs.

Residents with questions about their CenterPoint account can call 713-207-2222 or 800-332-7143.