CenterPoint Energy Reported a Data Breach Affecting 1,062,060 Texas Residents: What the Records Say, and Why Most of Those People Have Not Been Notified Yet

What Happened?

CenterPoint Energy, Inc. is the Houston-headquartered utility holding company that delivers electricity across the greater Houston area through CenterPoint Energy Houston Electric, LLC and natural gas through CenterPoint Energy Resources Corp.

In a Form 8-K filed with the Securities and Exchange Commission on September 14, 2026, CenterPoint stated that in September 2026 it “became aware of an online post by a third party claiming to have obtained a data set containing certain of the Company’s customer information.” The filing says the company activated its cybersecurity incident response protocols, began an investigation with outside cybersecurity experts, and took further steps to protect its systems.

The same filing states the finding that matters most to customers: “the Company has determined that an unauthorized third party obtained personal information relating to a portion of the Company’s customers through one of the Company’s external facing systems.” CenterPoint said it was continuing to work with third-party experts to determine the scope of customers and personal information affected, that it had reported the matter to law enforcement and notified certain regulatory authorities, and that it intended to notify affected customers and regulators as required by applicable law.

The filing also records what was not affected: CenterPoint stated that its delivery of electric and gas service “has not been impacted and remains operational and undisrupted.” This was an information incident, not an outage.

How the Texas Number Surfaced

The September filing gave no count. The number came a month later, out of a Texas record rather than a company announcement.

Texas requires a business that suffers a breach affecting at least 250 Texas residents to report it to the Attorney General, and those reports are compiled in the Attorney General’s data breach reporting system. In the week of October 12, 2026, that listing was reported to show CenterPoint’s incident at 1,062,060 Texas residents, with the affected categories described as names, addresses, Social Security information and driver license numbers.

Two details in that listing are worth reading closely. First, the report recorded that affected consumers had not yet been notified at the time it was submitted. Second, the Attorney General’s system notes that an affected-resident count and a notification status can both be updated later — so 1,062,060 is the figure reported to the State as of that filing, not a final tally.

CenterPoint’s public comment on October 14, 2026 was consistent with that: the company said it “continues to actively investigate the cybersecurity incident disclosed last month,” that it is working with third-party experts to determine the scope of affected data and which customers will receive notices, and that its electric and gas delivery services remain operational.

The Larger Unconfirmed Claim, Labelled as a Claim

Alongside the filings there is a much larger figure circulating, and it is important to be clear about where it comes from and what status it has.

A poster on a cybercrime forum, using the alias 4d722e4d656f77, claimed to have taken more than 7.49 million records from a CenterPoint-controlled application programming interface, and on September 12, 2026 posted a 2.5 GB archive said to contain the data. The poster alleged the interface lacked adequate authentication and rate limiting, and described fields including names, contact details, service and billing addresses, account and premise identifiers, billing and payment information, autopay and paperless status, and partial Social Security numbers.

None of that has been confirmed. CenterPoint has not verified the record count, the authenticity of the archive, or the data fields described, and its 8-K attributes the incident only to “one of the Company’s external facing systems” without describing how it was reached. The gap between 1,062,060 and 7.49 million is unexplained in the public record, and the two figures are not measuring the same thing: one is a count of Texas residents reported to a state regulator, the other is a claimed count of records across an unstated geography. CenterPoint also serves customers in Indiana, Minnesota and Ohio, and the Texas report speaks only to Texas residents.

Who Can Be Affected?

The affected population reported to Texas is drawn from CenterPoint’s customer records, which means the people most likely to appear in it are those who have held a CenterPoint electric or gas delivery account. CenterPoint Energy Houston Electric delivers power across the Houston metropolitan area, and CenterPoint’s gas operations reach well beyond it into South, Central and East Texas communities, so the reported million-plus figure is not confined to one county.

Two groups are easy to overlook. The first is former customers: a breach of historical account records can reach someone who closed an account years ago and no longer thinks of themselves as a customer. The second is people who share a household account but are not the named account holder, whose information may still sit in the same record.

Because notices had not gone out when the Texas report was submitted, the practical situation for most of these residents right now is that the absence of a letter is not information. CenterPoint has said it is still determining which customers will receive notices.

What Texas Law Requires of a Company After a Breach

Texas addresses breach notification in the Identity Theft Enforcement and Protection Act, chapter 521 of the Texas Business and Commerce Code. Section 521.053 sets two separate clocks, and they are facts rather than predictions about this case:

• Notice to affected individuals is to be given without unreasonable delay and not later than 60 days after the company determines that a breach occurred.
• Notice to the Texas Attorney General is required when a breach affects at least 250 Texas residents, as soon as practicable and not later than 30 days after the company determines that a breach occurred. The 30-day deadline replaced an earlier 60-day deadline under Senate Bill 768, effective September 1, 2023.

Both clocks run from the date the company determines a breach occurred, which is a different date from the date it first hears a rumor and a different date again from the date an investigation finishes. Working out which date applies to a particular company on a particular record is exactly the kind of question a lawyer examines, and it is not something a customer can settle from the outside.

Texas law also provides for a security freeze on a consumer file held by a consumer reporting agency, under chapter 20 of the Texas Business and Commerce Code. Many people affected by a breach involving Social Security or driver license information look into a freeze, a fraud alert, or credit monitoring, and an attorney can explain how those statutory tools fit a specific situation.

What Kind of Claim Might Apply?

Nothing here establishes that any particular person has a claim, and no one can tell from a news report whether a given household does. What can be described is the kind of work an attorney does with a record like this one.

Texas attorneys who handle data breach matters typically look at whether the information actually exposed for one person is the kind that can be misused, what the company knew and when it knew it, whether notice was given within the statutory windows, and whether there is identifiable harm — a fraudulent account, a filed tax return, a drained account, time and cost spent repairing a credit file. Claims in this area are commonly framed in negligence and under Texas consumer protection law, and breaches of this size frequently draw proposed class actions in which an affected resident may have a decision to make about participating. Enforcement of chapter 521 itself rests with the Attorney General, which is a reason a private claim is usually built on other theories — a distinction a lawyer can explain in plain terms.

An experienced consumer protection attorney can review the filings, any notice that arrives, and what has actually happened on a person’s accounts, and explain what options may exist for that specific situation.

Why Acting Quickly Can Matter

There is good news in the timing: this is early. The reported notices have not gone out, and the record is being built now rather than years after the fact, which is the better position to be in.

Two facts are worth knowing anyway. Under section 16.003 of the Texas Civil Practice and Remedies Code, a negligence action generally must be brought within two years, and when that period starts in a breach case can itself be contested. And in a proposed class action, the dates that matter to an individual are set by a court rather than by the company, which is why people often ask a lawyer to watch the docket for them rather than watch it themselves.

Records are also easiest to assemble while they still exist. Account statements, the envelope and date of any notice, screenshots of unfamiliar activity, and the correspondence from a bank or a credit bureau are the raw material a lawyer works from, and it is best to talk to a lawyer about what is worth keeping before anything is cleared out.

Sources

1. CenterPoint Energy, Inc., Form 8-K filed with the Securities and Exchange Commission, September 14, 2026, Item 8.01 Other Events — the September 2026 awareness of the third-party post, the determination that an unauthorized third party obtained personal information relating to a portion of customers through one of the company external facing systems, the report to law enforcement, the stated intent to notify affected customers, and the statement that electric and gas delivery was not impacted (primary source).
2. Texas Legislature, Texas Business and Commerce Code chapter 521, Identity Theft Enforcement and Protection Act — the breach-notification duty, the 60-day individual notice period, the 250-resident threshold and 30-day Attorney General reporting requirement, and the enforcement provisions (primary source).
3. Texas Legislature, Texas Business and Commerce Code chapter 20 — the security freeze available on a consumer file held by a consumer reporting agency (primary source).
4. Texas Legislature, Texas Civil Practice and Remedies Code section 16.003 — the two-year limitations period for negligence actions (primary source).
5. “More than 1 million Texans affected by CenterPoint data breach, AG report shows”, KPRC 2 Houston, October 14, 2026 — the 1,062,060 figure from the Attorney General listing, the data categories, the record that affected consumers had not yet been notified, and CenterPoint’s October 14 statement.
6. “CenterPoint Energy Data Breach Impacts 1 Million Texans”, SecurityWeek, October 15, 2026 — second independent account of the 1,062,060 figure and the data categories, the roughly one-month interval after the SEC disclosure, the apparent absence of notification letters, and CenterPoint’s service territory in Indiana, Minnesota and Ohio.
7. “CenterPoint Energy Data Breach: More Than 1 Million Texans Affected”, Security Affairs, October 16, 2026 — third independent account, including the September 12 forum post, the 7.49 million record claim, the 2.5 GB archive, the claimed data fields, and the note that the Attorney General figure is well below the claimed total.
8. “CenterPoint Energy confirms data breach after hacker claims 7.49M records”, CyberInsider — the threat actor alias, the claim that the interface lacked authentication and rate limiting, and the statement that CenterPoint has not confirmed the count, the archive or the fields.
9. “Texas Tightens State’s Data Breach Notification Law”, The National Law Review — independent confirmation that Senate Bill 768 shortened the Attorney General notice deadline from 60 days to 30 days effective September 1, 2023, and that the reporting threshold is 250 Texas residents.