The CenterPoint Energy breach: what is confirmed, and what to do

On 1 September 2026 someone offered CenterPoint customer data on a hacking forum, describing roughly 7.49 million rows taken through an external-facing interface. Law firms picked it up first: an investigation was announced on 10 September, and at least five proposed class actions were filed for customers in Texas, Indiana and Minnesota between 10 and 13 September. CenterPoint filed a Form 8-K with the SEC on 14 September confirming that an unauthorised third party had obtained personal information belonging to some of its customers through an external-facing system, and said that gas and electricity delivery was never affected. The order matters: the lawsuits arrived before the company’s own disclosure, which is why coverage of this breach reads as louder than the company’s account of it.

CenterPoint delivers electricity and natural gas to around seven million homes and businesses across Texas, Indiana, Minnesota and Ohio, and in much of that footprint it is the wires-and-pipes company rather than the brand on your bill. In deregulated parts of Texas you pick a retail electricity provider, but CenterPoint is the one that owns the meter, reads it and restores the line after a storm, so it holds the account and the service address regardless of whose logo is on the statement. If you have ever had the power connected at a Houston-area address, you have a record here whether or not you remember choosing the company.

The seller’s field list runs to names, phone numbers, email addresses, service and billing addresses, account and premise numbers, what each customer was billed and when it was due, whether they are on autopay, their rate class, driver’s licence numbers and the last four digits of Social Security numbers. CenterPoint has not confirmed any of it. Even so, read what the categories describe: not a password dump, but a verified record of who lives where, reachable on which number, paying how much. A utility account is one of the few datasets where the address is current by definition, because the service only works at the place you actually are.

There is no lookup for this one and there will not be until the data is published somewhere public, which it has not been. Nothing from this breach has reached the known breach databases that email checkers search, so a clean result tells you only that nothing has been indexed. The answer will arrive as a letter, once CenterPoint finishes working out whose records were in the file. Until then the useful assumption for a current or former CenterPoint customer is that your name, address and phone number are in circulation — which, inconveniently, is also true of most people regardless of this breach.

Freeze your credit at Equifax, Experian and TransUnion; it is free, it blocks new accounts, and a claimed licence number is the kind of detail that makes it worth doing now rather than later. Set a passcode or PIN on your CenterPoint account if it offers one, so a caller cannot talk their way past the last four digits of anything. Change the password on your online account, and anywhere you reused it. Then read one bill carefully, so you know what a real one looks like: the account number, the due date, the payment methods it actually accepts. Our step-by-step breach checklist puts the rest in order.

The utility disconnection scam is old and it works: a caller says the power goes off within the hour unless a payment goes through now, by prepaid card or app transfer, and keeps the person on the line so they cannot check. What a breach adds is the opening — an account number read back to you, the amount of your last bill, the address on file. None of that proves who is calling. A real utility sends written notice before disconnection, never demands gift cards, and has no objection to you hanging up and calling the number on your own bill. Tell the older people in your household the same thing, because they get these calls most often and the details make the call very hard to dismiss.

The class actions will take years, and the notification letters will arrive long before any of them resolve. Neither does anything about the underlying problem, which is that your name, home address and phone number are now a little more widely copied than they were in August — and were already published, for free, on dozens of people-search and data-broker sites that had nothing to do with this breach. That part you can actually change. Our guide to removing your home address from the internet covers how, and our guide to breach letters covers reading the notice when it lands.