CenterPoint Energy: customer data stolen via an external-facing system

What happened

• CenterPoint’s 8-K says a third party posted online claiming a data set of its customer information, and its investigation found an unauthorized party obtained personal information through “one of the Company’s external facing systems”. Electric and gas delivery “has not been impacted”. Number of customers and data types not disclosed (CM Alliance cites a claimed 7.49 million records; unverified).
• Root cause: compromise of an external-facing system; specifics not disclosed.
• Attacker: not identified.
• Response: law enforcement and regulators notified; third-party experts determining scope.

Sources

• https://www.sec.gov/Archives/edgar/data/48732/000110465926107560/tm2625326d1_8k.htm
• https://www.cm-alliance.com/cybersecurity-blog/major-cyber-attacks-data-breaches-ransomware-attacks-september-2026

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.