CenterPoint Energy Confirms Data Breach After Hacker Claims 7.5 Million Records Stolen

CenterPoint Energy has confirmed that an unauthorized third party accessed personal customer information through one of its external-facing systems. The disclosure, made in a Form 8-K filing with the SEC on September 14, 2026, marks a significant security failure for the major utility provider.

In the filing, CenterPoint Energy stated that the company determined an intruder obtained personal information relating to a portion of its customer base. This admission follows a post on a cybercrime forum where a threat actor, using the alias '4d722e4d656f77', claimed to have stolen approximately 7.49 million records. While the company has officially confirmed the breach, it has not yet verified the specific number of records compromised or the exact categories of data stolen.

Infrastructure Under Pressure

CenterPoint Energy is a critical piece of regional infrastructure, serving approximately 7 million customers across Texas, Indiana, Ohio, and Minnesota. The company noted that despite the unauthorized access to data systems, its core operations remained secure; electricity and gas services continued to operate without disruption during the incident.

This breach occurs as part of a wider, escalating trend of cyberattacks targeting critical infrastructure across the United States and Europe. Recent months have seen a surge in intrusions targeting power plants and water systems, suggesting that essential service providers are increasingly viewed as high-value targets by threat actors seeking either financial gain or systemic disruption.

Risks to Consumers

Although the company has not confirmed the specific data fields leaked, the claim of nearly 7.5 million stolen records—roughly equivalent to the company's entire customer base—raises severe concerns regarding identity theft. When utility providers are breached, the resulting exposure of personal identifiers can provide attackers with the necessary foundations to conduct sophisticated fraud or phishing campaigns against millions of residents.

Beyond the immediate risk to individuals, the incident underscores a systemic vulnerability in how essential services manage external-facing systems. Even when operational delivery of power and gas is maintained, the compromise of the administrative and customer-facing perimeter can lead to long-term reputational and financial damage for the provider.

Next Steps

CenterPoint Energy has not yet provided a detailed timeline for the breach or a comprehensive list of affected individuals. Industry analysts are now watching for further SEC disclosures or direct notifications to customers. It remains to be seen whether the company will verify the claims made by the threat actor regarding the volume of data extracted or if the actual scope of the breach is smaller than the 7.49 million records claimed on the cybercrime forum.