CenterPoint Energy confirms intruder helped themselves to customer information

CenterPoint Energy, a Texas utility serving approximately 7 million customers, has confirmed that an intruder accessed its systems and stole personal information. The breach was first reported on a cybercrime forum, where the attacker claimed to have stolen customer files. Despite the ongoing investigation, the company has determined that personal data of some customers was compromised through an unsecured external-facing system.

CenterPoint's electricity and gas services remained unaffected by the incident. The company is cooperating with third-party experts to assess the extent of the breach and will notify affected customers and relevant authorities as required by law. The individual claiming responsibility stated that they obtained around 7.49 million files from a poorly secured Application Programming Interface (API).

The alleged data includes names, contact details, billing information, move-in dates, driver's license details, and the last four digits of Social Security numbers. However, The Register has not independently verified the contents of the data dump, and CenterPoint has not confirmed the veracity of the claims. The company believes the incident is unlikely to significantly impact its financial performance or operational results.

Cyberattacks on critical infrastructure, such as utility providers, can have severe consequences, as demonstrated by recent incidents in Poland, the UK, and over 100 US water systems affected by attacks in July. The US government has been vigilant about the cyber threats posed by hostile states due to the potential disruption of essential services.