CenterPoint Energy confirms intruder helped themselves to customer information

Texas-based utility provider CenterPoint Energy has acknowledged a security breach that resulted in the theft of customer data. The company announced the incident in a Form 8-K filing with the Securities and Exchange Commission, following a post on a cybercrime forum that purportedly offered the stolen customer data. Serving approximately 7 million customers, CenterPoint's electricity and gas services have remained unaffected.

The company's investigation is ongoing, but it has determined that an unauthorized third party accessed personal information from one of the company's external-facing systems. CenterPoint is collaborating with third-party experts to ascertain the scope of the affected customers and personal information and plans to notify those impacted as mandated by law.

The company reported the matter to law enforcement and has alerted relevant regulatory authorities. The alleged intruder claimed they acquired 7.49 million files from CenterPoint's API, which included customer names, contact details, billing information, move-in dates, driver's license data, and the last four digits of Social Security numbers.

While the Register has not independently confirmed the contents of the alleged data dump, CenterPoint has not confirmed or refuted the claims. The company remains confident that the incident is unlikely to significantly impact its financial performance or business operations. Critical infrastructure cyberattacks can have severe consequences, as evidenced by recent disruptions in Poland and the UK, as well as attacks on over 100 US water systems in July.

The US government consistently warns about the cyber threats faced by utility providers due to the potential for these attacks to disrupt essential services.