CenterPoint Confirms Customer Data Stolen in Cyberattack
Summary
CenterPoint confirmed an unauthorized third party obtained some customers’ personal information. A threat actor claimed to have stolen 7.49 million records; the company says utility services were unaffected and its investigation continues.
Key points
- CenterPoint told the SEC that an unauthorized third party obtained personal information relating to some customers through an external-facing system.
- A threat actor claimed to have stolen and leaked 7.49 million records; CenterPoint has not confirmed the number of affected customers or the data types involved.
- The actor said they accessed records by iterating through IDs on a public API that allegedly lacked rate limiting and WAF protection.
- The leaked data reportedly included names, contact and service details, account numbers, billing amounts, and partial Social Security numbers.
- CenterPoint says electric and gas services were not affected and it does not expect a material impact on its business or financial condition.
- The company activated incident-response procedures, engaged cybersecurity experts, strengthened system protections, and notified law enforcement and regulators; its investigation is ongoing.
Article Details
- Victim Organization
- CenterPoint Energy
- Incident Type
- Unauthorized access to customer personal information and data theft via an external-facing system; the attacker claimed to have accessed the company’s public API.
- Data Types Exposed
- Names
- Phone numbers
- Service and billing addresses
- Account numbers
- Billing amounts
- Partial Social Security numbers
- Affected Records
- The threat actor claimed to have stolen 7.49 million customer records; CenterPoint Energy did not disclose the number of affected customers.
- Operational Impact
- CenterPoint Energy said its electric and gas services were not affected and that it did not expect a material impact on its business or financial condition. The investigation was ongoing.
- Ransom Or Extortion
- The threat actor claimed the company ignored their messages before leaking the data. No ransom demand is reported.
- Claim Status
- confirmed