Your utility company knew. You didn’t.
CenterPoint Energy told Texas regulators this week that a data breach exposed the personal information of 1,062,060 Texas residents. Names, home addresses, Social Security numbers, driver’s license numbers. The filing landed in the Texas Attorney General’s breach database on October 13-14, and here’s the part that should bother you: when the company submitted that filing, it had not yet notified the affected customers.
You may find out your SSN was stolen from a news article before you hear it from the company that lost it.
What the filing actually confirms
CenterPoint first disclosed the incident in a September 14 SEC filing. The company said it learned of an online post by a third party claiming to possess customer data, activated its incident response, brought in outside cybersecurity experts, and contacted law enforcement. The unauthorized party got in through one of CenterPoint’s external-facing systems.
What was confirmed exposed, per the AG filing: full names, addresses, Social Security numbers, and driver’s license numbers. That combination is the full starter kit for identity theft. A name and address alone is a nuisance. Add an SSN and a driver’s license number and someone can open credit accounts, file tax returns, and impersonate you to institutions that still treat those numbers as proof of identity.
What was not affected: electricity and natural gas delivery. The grid kept running. This was a data theft, not an infrastructure attack.
In an October 14 statement, the company said it continues to investigate with external cybersecurity, forensic, and legal advisors, and is working to assess the scope “to identify which customers will be provided notifications in accordance with applicable legal requirements.” Translation: the notification letters are still being figured out.
The 7.5 million number you may have seen
Before CenterPoint’s confirmed figure existed, a hacker on a known cybercrime forum claimed to have nearly 7.5 million CenterPoint customer records. The same actor reportedly made a 2.5-gigabyte archive available for download in mid-September, allegedly containing around 3 million phone numbers plus account and billing details, move-in dates, autopay enrollment status, and partial SSNs.
CenterPoint has not confirmed any of that. The company’s confirmed count is 1,062,060 Texans, via the AG filing. The gap between the attacker’s boast and the company’s filing is worth keeping in mind, but the confirmed number alone is large enough to take seriously. One million-plus SSNs is not a minor incident by any measure.
One more open question: CenterPoint also delivers power and gas in Indiana, Minnesota, and Ohio, serving about 7 million metered customers across the four states. Whether residents outside Texas are affected remains unclear.
Lawsuits are already filed
Five proposed class-action lawsuits were filed against CenterPoint in federal court between September 10 and 13, before the company’s SEC disclosure. Three were filed by Florida firm Shamis and Gentile, two by Dallas firm Lippe and Associates. The plaintiffs are residents of Indiana, Texas, and Minnesota. No class has been certified yet. The suits allege CenterPoint failed to protect customer data and violated FTC guidance on safeguarding consumer information.
The clock Texas law puts on this
Texas law gives this story a measurable deadline. Under Texas Business and Commerce Code Section 521.053, a breach affecting at least 250 Texas residents must be reported to the Attorney General within 30 days of determining the breach occurred. Affected consumers must be notified without unreasonable delay, and no later than 60 days after the determination. CenterPoint’s SEC filing was September 14. The AG filing with the 1,062,060 figure appeared October 13-14. The 60-day consumer notification clock is ticking.
I’m a CenterPoint customer. What do I do right now?
If CenterPoint delivers your electricity or gas, assume your data may be in the exposed set until the company tells you otherwise. The exposed data includes SSNs and driver’s license numbers, which means the risk is new-account identity theft. Take these steps this week, in this order.
- Freeze your credit at Equifax, Experian, and TransUnion today. A freeze is free by federal law and blocks new accounts from being opened in your name.
- Pull your free credit reports at AnnualCreditReport.com and scan for accounts you did not open.
- File your taxes as early as you can next season. A stolen SSN plus a slow filer is how tax refund fraud happens.
- Watch for a notification letter from CenterPoint, but do not wait for it to act. The filing says customers had not been notified yet.
- Be skeptical of calls or texts claiming to be CenterPoint about this breach. Scammers work breach news fast. Verify through the company’s official channels.
One honest footnote on timing: credit freezes take effect within one business day when requested online or by phone. There is no reason to wait until the notification letter arrives.
What we still don’t know
The investigation is ongoing, and several things remain unresolved. Whether the attacker’s 7.5 million claim has any basis. Whether customers in Indiana, Minnesota, and Ohio are affected. When notification letters will actually go out, and what remediation the company will offer. The AG filing is a snapshot, not the final word, and the affected count may be updated.
What is not in doubt: over a million Texans’ SSNs and license numbers are confirmed exposed, and most of them found out from regulators and reporters, not from their utility company.
Sources
- SecurityWeek, “CenterPoint Energy Data Breach Impacts 1 Million Texans,” October 15, 2026
- Houston Chronicle, October 2026
- KTRH/iHeart Houston, October 15, 2026
- Security Magazine, October 15, 2026
- CenterPoint Energy SEC filing, September 14, 2026
