CenterPoint Energy confirms customer data breach after hacker claims 7.49 million records stolen via unsecured API

On 16 September 2026, CenterPoint Energy — the Houston-based electric and natural gas utility serving millions of customers across several U.S. states — confirmed that an unauthorized third party had accessed customer information held in one of its external systems, after a threat actor publicly claimed to have stolen a large database from the company.

The claim first surfaced on 1 September 2026, when a user posting under the handle "4d722e4d656f77" advertised a data set said to belong to CenterPoint on an open-web forum. In a Form 8-K filed with the U.S. Securities and Exchange Commission on 14 September, the company said it had become aware of the online post and had launched an investigation with outside experts. Reporting confirming the breach appeared on 16 September.

An exposed API

According to the attacker's account, the records were pulled through an application programming interface that had no web application firewall, no rate limiting, no certificate checks and no authentication token, allowing automated extraction to continue until a CAPTCHA interrupted the download at roughly 7.49 million lines — a figure CenterPoint has not confirmed. The fields listed in the sample included customer names, phone numbers, service and billing addresses, account and premise identifiers, billing amounts and due dates, autopay and paperless-billing status, rate class, email addresses, driver's license numbers and the last four digits of Social Security numbers.

Response

CenterPoint said full financial account details were not part of the exposed data set, and that it would notify affected customers and regulators as required by law. With the investigation into the scope and authenticity of the leaked data still under way, the incident's status remained ongoing at the time of disclosure.