BleepingComputer (15 September 2026) reports Houston-based utility CenterPoint Energy confirmed in an SEC filing that an unauthorized third party obtained personal information for a portion of its customers through an external-facing system.

A threat actor alias “4d722e4d656f77” told BleepingComputer they exfiltrated about 7.49 million customer records (names, phones, service/billing addresses, account numbers, billing amounts, partial SSNs) by iterating IDs on a public API alleged to lack rate limiting/WAF.

CenterPoint says electric and gas services were not impacted and does not expect a material business effect; it activated IR, engaged third-party experts, hardened systems, and notified law enforcement/regulators. Class-action complaints filed in US federal courts allege the incident window was about 17 August–1 September 2026. Company has not publicly matched the actor’s record count or data-type claims in the SEC text cited by the wire.

Primary wire: BleepingComputer; company confirmation: SEC filing as cited there.

UPDATE 15 October (SecurityWeek): CenterPoint told the Texas Attorney General's Office this week that 1,062,060 Texas residents were affected and that names, addresses, Social Security numbers and driver's licence numbers were compromised.

SecurityWeek says notification letters do not yet appear to have gone out to affected people, and that CenterPoint also serves electricity and gas customers in Indiana, Minnesota and Ohio who may be affected too, so the total remains unclear; CenterPoint had not answered SecurityWeek's request for an overall count. On 12 September the actor made a 2.5 GB archive available for download that appears to hold about 3 million phone numbers plus other personal information.