CenterPoint Energy Data Breach: What Was Exposed

In short: CenterPoint Energy confirmed in a Texas regulatory filing that a breach exposed the names, addresses, Social Security numbers and driver's license numbers of 1,062,060 Texas residents, reported October 13, 2026. As of that filing, affected customers had not yet been notified, and CenterPoint says it is still determining the full scope.

CenterPoint Energy, the Houston-based utility that delivers electricity and natural gas, disclosed in a Securities and Exchange Commission filing that an unauthorized third party accessed customer data through one of its external-facing systems. If you're a CenterPoint customer in Texas, here's what's confirmed, what isn't, and what to do before you get a letter.

What should I do right now if I was affected?

Don't wait for a notification letter — act now, since the data is already out:

1. Watch for phishing. Scammers now have your real name and address, which makes fake texts and emails from "CenterPoint" or "your bank" look convincing; see our guide on how to spot phishing after a data breach.
2. Freeze your credit at all three major bureaus — Equifax, Experian and TransUnion — which is free and can be done online or by phone with each. Your Social Security number and driver's license number together are enough for someone to open new credit in your name.
3. Set a fraud alert on your credit file as a lighter-weight alternative or addition to a freeze.
4. Change your CenterPoint password if you've reused it anywhere else — a general precaution; no source indicates account credentials were part of this breach.
5. Monitor your credit report and bank statements for accounts or inquiries you don't recognize.
6. Check the Texas Attorney General's breach database yourself at the Data Security Breach Reports page rather than relying on a letter, since notice to individuals hadn't gone out as of the filing.
7. Ignore any site offering to sell you "leaked" CenterPoint data or check whether you're in it. Only CenterPoint, the Texas AG filing and CenterPoint's SEC disclosures are official sources.

What personal data was exposed in the CenterPoint Energy breach?

The Texas AG filing lists the exposed information as name of individual, address, Social Security number information, and driver's license number, according to reporting on the listing published October 13, 2026. CenterPoint's own SEC filing is less specific, saying only that "an unauthorized third party obtained personal information relating to a portion of the Company's customers" through one of its external facing systems.

How many people were affected by the CenterPoint Energy breach?

The confirmed figure is 1,062,060 Texas residents, per the Texas AG's database entry reported by ABC13 Houston. Separately, a hacker's dark web post claimed about 7.5 million records were stolen in total, including the last four digits of Social Security numbers, billing information and account details, as reported by The Record. That larger number is an unverified criminal claim, not a confirmed figure from CenterPoint or regulators, and the data types it describes differ from what the Texas AG filing lists.

Have I been notified, and when will I receive notice?

As of the AG filing, CenterPoint had not yet contacted affected customers. ABC13 reported that "the report also shows that CenterPoint has not yet contacted those customers," and a company statement said it is still working with outside experts to figure out which customers will get notifications once the legal requirements for doing so are met, per ABC13's reporting. Texas breach notification law gives a business 60 days to notify affected individuals and 30 days to report to the Attorney General once 250 or more Texans are involved, both counted from the day the breach is determined, according to legal analysis of the filing timeline. CenterPoint has not said publicly when it determined the breach, so the exact deadline isn't knowable from the filings.

Could my data have been sold, or is it still at risk?

That's unconfirmed. CenterPoint learned of the incident from an online post by a third party claiming to have obtained a customer dataset, not from its own detection systems, per its SEC filing. When ABC13 asked CenterPoint directly what data was taken, which customers were affected, how it happened, or when, "company officials pointed back to the SEC filing," according to ABC13's earlier report. CenterPoint has reported the matter to law enforcement and notified some regulatory authorities, and says its electric and gas delivery "has not been impacted and remains operational and undisrupted."

What don't we know yet?

Several things remain unconfirmed as of the SEC filing and subsequent reporting:

• Who did it. No attacker has been publicly identified by CenterPoint or confirmed by investigators.
• The exact final scope. CenterPoint says it is still working with third-party experts to determine the full scope of customers and data affected.
• Whether the data has been sold or used in fraud. No source confirms this has happened, only that a hacker claimed to possess the dataset.
• The exact notification date customers will receive. CenterPoint has not announced one publicly as of the sourced reporting.

CenterPoint serves about 7 million customers across Indiana, Minnesota, Ohio and Texas, so customers in those other three states could in theory be affected too, though no breach notice filings confirming impact there have been found. Only the Texas figure, drawn from the state's public filing, is currently confirmed.