CenterPoint Energy, the electric and gas utility serving Missouri City and the greater Houston area, confirmed that an unauthorized third party obtained personal information belonging to some of its customers.
The company disclosed the breach in a Form 8-K filed with the U.S. Securities and Exchange Commission on Monday, Sept. 14. CenterPoint said it learned of an online post by someone claiming to have obtained a dataset of customer information. The company activated its cybersecurity response protocols and brought in outside experts to investigate.
CenterPoint has not said how many customers were affected or what types of personal data were taken. The company said it is still determining the scope.
What a threat actor claimed
A threat actor posted on a public web forum on Sept. 1 claiming to possess approximately 7.49 million raw records tied to CenterPoint customers, according to Tech Insider. CenterPoint has not confirmed that figure or verified the dataset.
Samples of the alleged data reviewed by cybersecurity outlet Cyber Insider reportedly included customer names, phone numbers, email addresses, service and billing addresses, billing amounts, payment status, autopay enrollment and the last four digits of Social Security numbers. CenterPoint has not confirmed those data types.
Lawsuits already filed
Five proposed class-action lawsuits were filed against CenterPoint in the Southern District of Texas before the SEC disclosure, the Houston Chronicle reported. The suits place the breach between Aug. 17 and Sept. 1. Three of the lawsuits, filed by Florida firm Shamis and Gentile, point to CenterPoint's online guest bill pay feature as the alleged entry point. No class has been certified in any of the cases.
One lawsuit, filed on behalf of customer Latoya Wyche, alleged CenterPoint "had the resources necessary to prevent the Data Breach but neglected to adequately invest in security measures, despite its obligation to protect such information."
Services not disrupted
CenterPoint said its electric and gas delivery remains operational. The company stated it does not expect the breach to have a material financial impact and said it carries cybersecurity insurance to offset related costs.
A CenterPoint spokesperson told KPRC 2 on Tuesday, Sept. 15, "Our filing speaks for itself."
What Missouri City residents should know
CenterPoint serves roughly 2.8 million electric customers across the Houston metro area, including Missouri City. The company said it intends to notify affected customers and regulatory authorities as required by law.
Under Texas law, companies must notify the state attorney general within 30 days of discovering a breach involving at least 250 residents. They must notify affected individuals without unreasonable delay, and no later than 60 days after determining the breach occurred. As of Sept. 8, no Texas attorney general filing related to the incident had been made public, according to teiss.
Customers with questions can call CenterPoint at 1-800-332-7143.
