A CenterPoint Energy data breach compromised personal information belonging to more than 1 million Texas customers, according to a report filed with the Texas Attorney General's Office.
The state's data breach database lists 1,062,060 affected Texans, Click2Houston reported on Wednesday, Oct. 14. The exposed data includes names, addresses, Social Security numbers and driver's license numbers.
CenterPoint manages the electric grid and provides natural gas service across the Houston area, including Missouri City and Stafford. That means local residents are among those potentially exposed.
None have been notified.
The attorney general's breach report, which the Houston Chronicle reported was released Tuesday, Oct. 13, shows CenterPoint had not contacted any of the 1,062,060 affected customers as of the filing date. The state noted that the number of affected Texans and the notification status may later be updated.
A CenterPoint spokesperson said the company is still working with outside experts to determine which customers will receive notifications as required by law. The company said its electric and gas delivery has not been disrupted.
CenterPoint first disclosed the incident in a Sept. 14 filing with the U.S. Securities and Exchange Commission. In that filing, the company said it learned of an online post by a third party claiming to have obtained a dataset of customer information. CenterPoint said it activated cybersecurity response protocols and hired outside investigators.
At the time of the SEC filing, CenterPoint did not reveal how many customers were affected or what types of personal data were compromised. The attorney general's report filled in those gaps, specifying names, addresses, Social Security numbers and driver's license numbers.
A class-action lawsuit was filed against CenterPoint on Sept. 10 in Houston, alleging the company failed to adequately secure customers' personal information, KHOU reported.
Under the Texas Identity Theft Enforcement and Protection Act, companies must report breaches affecting 250 or more Texans to the attorney general within 30 days. Affected consumers must be notified no later than 60 days after the company determines a breach occurred, according to the attorney general's office. Violations can carry civil penalties of $2,000 to $50,000 per violation, plus up to $250,000 per breach for failing to take reasonable action to notify consumers.
Cybersecurity expert David Taxer of Texas Cyber Solutions told KHOU in September that even limited account information could let scammers impersonate CenterPoint in phone calls. "What I would be most concerned about now is scammers calling people up, impersonating CenterPoint Energy, having information like their account number, one of their recent power bill amounts," Taxer said.
CenterPoint serves nearly 2.8 million metered electric customers in the Houston area and 1.9 million gas customers across Texas, according to the company's website. Residents who suspect fraudulent activity tied to the breach can file a complaint with the Texas Attorney General's consumer protection division.
