If you pay an electric or gas bill every month, you probably think about the amount due, not all the personal information sitting behind that account. But your may have your home address, phone number, billing history and other details that can become very useful in the wrong hands. That is what makes the breach at CenterPoint Energy worth paying attention to, even if you have never been one of its customers.
CenterPoint says an unauthorized third party obtained personal information belonging to some customers through an external-facing system. A hacker, meanwhile, claims to have stolen 7.49 million customer records, including addresses, account numbers, billing information and partial Social Security numbers.
There is an important catch. CenterPoint has confirmed that , but it has not confirmed the hacker’s 7.49 million figure or the specific information the attacker says was taken. So, there are still plenty of questions about how big this breach really is. Here’s what CenterPoint has confirmed, what the hacker is claiming and what you should watch for now.
NEW! 𩺠Free CyberGuy LIVE class: Get Better Healthcare With AI Saturday, September 26 at 11 a.m. ET / 8 a.m. PT
Kurt “CyberGuy” Knutsson will show you five practical ways AI can help you organize your health history, remember important appointment details, understand complicated medical information, research prescriptions and prepare smarter questions for your doctor. No technical experience is needed.
Save your free spot at CyberGuyLive.com
Register and receive the replay and step-by-step guide afterward.
DMV BREACH CONFIRMED AS HACKERS CLAIM 200,000 RECORDS STOLEN
CenterPoint Energy disclosed the incident in a Sept. 14 filing with the U.S. Securities and Exchange Commission. The Houston-based utility says it became aware of an online post from a third party claiming to possess a data set containing CenterPoint customer information.
CenterPoint then activated its cybersecurity incident response procedures and brought in outside cybersecurity experts. As the investigation progressed, the company determined that an unauthorized third party had obtained personal information belonging to some customers through one of its external-facing systems.
CenterPoint has not publicly said how many customers were affected. It also has not detailed which types of personal information were taken. The company says it plans to notify affected customers and regulators as required once it determines the scope of the incident.
CyberGuy reached out to CenterPoint Energy asking whether it could confirm the hacker’s claim that 7.49 million records were stolen, what customer information was affected and whether a public API was involved. CenterPoint referred us to its SEC filing and provided this statement: “Our filing speaks for itself.” The company did not provide additional details in response to our questions.
There is one piece of reassuring news for anyone who depends on CenterPoint for power or gas. The company says its electric and natural gas services continued operating normally during the incident. CenterPoint also says it currently does not expect the breach to have a material impact on its financial condition.
The bigger number comes from the attacker. A threat actor using the alias “4d722e4d656f77” told BleepingComputer that they obtained 7.49 million CenterPoint customer records.
According to the hacker, those records contain:
The attacker later leak
