CenterPoint Energy Confirms 1.06 Million Texans Exposed After Forum Post Disclosure

CenterPoint Energy filed notice with the Texas Attorney General after a threat actor publicly claimed exfiltration of 7.5 million records and released a 2.5 GB archive containing roughly 3 million phone numbers. The company told the SEC it discovered the breach via the external post rather than internal systems and confirmed no operational impact while noting only a portion of customers were hit. Direct notifications to individuals have not been issued.

The evidence trail shows delayed internal detection and reliance on public claims, consistent with patterns in prior utility incidents where contract and procurement records reveal insufficient monitoring investments. CenterPoint's multi-state footprint in Indiana, Minnesota, and Ohio suggests the total affected population exceeds the Texas figure, yet no cross-jurisdictional filings have surfaced.

This case underscores utilities ignoring known detection gaps until external pressure forces disclosure, increasing identity theft exposure for residents. Regulators may now examine whether prior security audits flagged the same weaknesses.

Additional state filings and potential class actions are expected within 60 days as the data's authenticity is verified through independent samples.