Get DeafLetter
A weekly selection of signals, vulnerabilities and guides. Critical alerts remain optional.
You can unsubscribe at any time. Privacy policy.
On October 14, 2026, the Texas Attorney General published a notice in its public database certifying that 1,062,060 state residents were caught up in a cybersecurity incident at CenterPoint Energy. The filing, made public in the absence of direct consumer notifications, indicates that names, addresses, Social Security information, and driver's license numbers were compromised. The case highlights the systemic gap between the technical timeline of an attack and the pace of regulatory transparency in the critical infrastructure sector.
- The Texas AG published a report citing 1,062,060 affected Texans; at the time of publication, consumers had not yet been notified.
- Compromised data includes names, addresses, Social Security numbers, and driver's license numbers.
- CenterPoint disclosed the incident via an SEC filing on September 11, 2026, without specifying the number of customers or the types of data exposed.
- A threat actor claimed 7.49 million records, a figure unverified by the company; the claimed method was iterating through a public API lacking rate limiting.
What the Texas Attorney General Report Says
The Texas Attorney General's publicly accessible database logs the notice with the precise figure of 1,062,060 affected individuals. According to Click2Houston and the Houston Chronicle, the report lists four categories of information: names, addresses, Social Security number data, and driver's license numbers. An attached note specifies that consumers had not yet been informed at the time of publication.
Texas law requires companies to notify the Attorney General within 30 days of determining a breach occurred and to alert consumers within 60 days. The AG report does not specify when the determination was made, making it impossible to verify whether the regulatory window was met. The filing includes the standard clause that the number of affected individuals "may be updated later."
The Timeline: From SEC 8-K to State Database
CenterPoint Energy publicly disclosed the incident via an SEC 8-K filing dated September 11, 2026, as confirmed by BleepingComputer, SecurityWeek, and The Record. The document, cited by BleepingComputer, states: "an unauthorized third party obtained personal information relating to a portion of the company's customers through one of the company's externally facing systems." The filing provided no counts or details on data types.
A month passed between the September SEC filing and the October AG report without direct communication to data holders. The Houston Chronicle requested clarification from CenterPoint on the correspondence between the two documents; the company did not explicitly confirm that the AG report refers to the same incident disclosed in the 8-K, though sources treat the two events as related.
"CenterPoint continues to actively investigate the cybersecurity incident disclosed last month. Upon discovery of the issue, CenterPoint activated its incident response procedures and engaged external cybersecurity, forensic, and legal advisors to assist the investigation." — CenterPoint Energy Spokesperson, via Click2Houston and Houston Chronicle
The Threat Actor and Unverified Claims
Starting in August–September 2026, a threat actor operating under the alias "4d722e4d656f77" claimed on specialized forums to have exfiltrated 7.49 million records from CenterPoint, with a filtered counterpart of 6,734,894 records according to a specialized source. BleepingComputer communicated directly with the actor, who stated they iterated millions of IDs through a public CenterPoint API that lacked rate limiting and WAF protection.
CenterPoint confirmed it detected an online post by a third party claiming possession of customer data but has neither verified nor denied the actor's counts or confirmed the technical method. SecurityWeek notes the same alias has made unverified claims about CenterPoint in the past, warranting caution regarding the validity of the current assertions. No ransom demand has been documented; BleepingComputer reports the actor's claim that the company "ignored messages."
The AG count of 1,062,060 affected individuals in Texas represents a significant fraction of the company's 2.8 million electric and 1.9 million gas customers in the state alone, but remains far short of the 7.49 million claimed by the actor. The discrepancy could reflect geographic filtering, deduplication, or the limits of unverified claims.
Why This Matters
The dossier presents significant limitations that frame the overall picture. The source does not specify whether the AG report and the SEC filing refer to the exact same incident, nor has it confirmed the technical intrusion vector. There is no indication the data has been used for fraud or identity theft as of publication. The total geographic scope remains unknown: the AG report covers only Texas, while CenterPoint operates across four states with a total customer base of approximately 7 million, per BleepingComputer.
The delay between regulatory filing and consumer notification raises questions about the practicality of disclosure timelines for utilities. Critical infrastructure customers cannot switch providers; personal data sharing is mandated by public service, making the breach a failure of imposed trust. The combination of SSNs and driver's license numbers exposes victims to synthetic identity fraud, a form of abuse that exploits precisely this pairing of government identifiers and biographical data.
Concurrently with the incident, the federal government awarded CenterPoint a $50 million grant for power grid security, as documented by the Houston Chronicle. The temporal overlap between infrastructure security investments and failure to protect consumer data fuels tension between resource allocation and operational accountability.
Legal and Regulatory Fallout
The Houston Chronicle and BleepingComputer confirm that class actions have been filed in multiple federal jurisdictions following the breach. The suits raise questions of due diligence in data protection and notification timelines. The SEC filing's omission of the number of customers and data types exposed may draw Securities and Exchange Commission scrutiny regarding the adequacy and timeliness of investor disclosure.
The Texas AG report does not clarify whether consumer notifications were subsequently issued after the October 14, 2026 publication. The absence of confirmation on this point leaves the current status of direct communications to data holders an open question.
CenterPoint has repeatedly stated that its electric and gas distribution systems were not compromised and that service remains operational. The separation between IT and OT emerges as a confirmed element across all sources, though the boundary between "externally facing systems" and operational infrastructure is not detailed in the dossier.
Unanswered Questions
Do the AG report and SEC filing refer to the same incident?
CenterPoint has not explicitly confirmed the correspondence. The Houston Chronicle requested clarification without receiving a direct response. Sources treat the two documents as related, but the dossier records this connection as unverified.
What is the definitive number of affected individuals?
The AG report indicates 1,062,060 Texans with the note that the figure "may be updated later." The actor's claim of 7.49 million records is unverified by the company. The total scope across all CenterPoint operating states remains unknown.
Have customers been notified?
At the time of the AG report's publication, consumers had not been informed. The dossier contains no updates subsequent to that date on whether communications were initiated.
Sources
- https://www.click2houston.com/news/local/2026/10/14/more-than-1-million-texans-affected-by-centerpoint-data-breach-ag-report-shows/
- https://www.houstonchronicle.com/news/houston-texas/article/centerpoint-data-breach-22476332.php
- https://www.yahoo.com/news/articles/centerpoint-energy-data-breach-affects-132217937.html
- https://tech-insider.org/centerpoint-energy-data-breach-7-49-million-records-2026/
- https://www.houstonchronicle.com/news/houston-texas/trending/article/drivewealth-data-breach-texas-22464805.php
- https://www.bleepingcomputer.com/news/security/centerpoint-energy-confirms-customer-data-stolen-in-cyberattack/
- https://www.securityweek.com/texas-utility-centerpoint-energy-confirms-breach-after-hacker-leaks-data/
- https://therecord.media/centerpoint-energy-data-breach
- https://www.click2houston.com/
Information verified against cited sources and current as of publication.
Sources
Get DeafLetter
A weekly selection of signals, vulnerabilities and guides. Critical alerts remain optional.
You can unsubscribe at any time. Privacy policy.