CenterPoint Energy confirmed that an unauthorized third party stole personal information from some of its customers. The breach could affect households across Friendswood, Webster, Seabrook, Nassau Bay and Clear Lake Shores.
The Houston-based utility disclosed the breach in a Form 8-K filed with the U.S. Securities and Exchange Commission on Monday, Sept. 14. The company said it learned in September about an online post from a third party claiming to possess a dataset of customer information.
CenterPoint has not said how many customers were affected or what types of personal data were taken. The company said it is working with outside cybersecurity experts to determine the scope and plans to notify affected customers as required by law.
As of Tuesday, Sept. 15, no notifications had gone out.
A spokesperson told KPRC 2, "Our filing speaks for itself." When ABC13 asked what customer information was obtained, which customers were affected and how the data was accessed, company officials pointed back to the SEC filing.
The company said electric and natural gas services were not disrupted.
Class-action lawsuits filed
A class-action lawsuit was filed Sept. 10 in Houston, alleging CenterPoint failed to adequately secure customers' personal information, KHOU 11 reported. Multiple additional class-action suits have since been filed in federal courts, according to BleepingComputer.
Those lawsuits allege the breach occurred between Aug. 17 and Sept. 1, BleepingComputer reported. CenterPoint has not confirmed those dates.
A threat actor claimed to have stolen 7.49 million customer records, including names, phone numbers, billing addresses, account numbers, billing amounts and partial Social Security numbers, according to BleepingComputer. CenterPoint has not confirmed that figure or the authenticity of the published dataset.
What Texas law requires
Under the Texas Identity Theft Enforcement and Protection Act (ITEPA), businesses must notify affected Texas residents no later than 60 days after determining a breach occurred. If at least 250 Texas residents are affected, the company must also report to the Texas Attorney General within 30 days.
CenterPoint said it reported the matter to law enforcement and has notified certain regulatory authorities. The company said it maintains cybersecurity insurance coverage and believes that insurance will offset related costs.
CenterPoint serves roughly 7 million metered customers across Texas, Indiana, Minnesota and Ohio, according to BleepingComputer. The company has not disclosed how many of those customers are in the Greater Houston area or the Clear Lake region.
Under Texas law, CenterPoint has up to 60 days after determining the breach occurred to notify affected residents. The company has not said when that clock started.
