Personal data belonging to more than 1 million CenterPoint Energy customers in Texas has been compromised in a data breach, the Texas Attorney General's Office confirmed in a report published Tuesday, Oct. 13.
The state's data breach database lists 1,062,060 affected Texans, KPRC 2 first reported. The exposed information includes names, addresses, Social Security information and driver's license numbers, according to the AG's report.
CenterPoint delivers electricity and natural gas to nearly 2.8 million metered customers across the Houston area, according to its website. That service territory covers the Clear Lake region, meaning the breach could affect households throughout Webster, Seabrook, Nassau Bay, Friendswood and Clear Lake Shores.
As of the AG filing, affected consumers had not been notified. The state noted that the total number and notification status may be updated later.
CenterPoint first disclosed the incident in a Sept. 14 filing with the U.S. Securities and Exchange Commission (SEC). In that filing, the company said it became aware of an online post by a third party claiming to have obtained a dataset of customer information. CenterPoint did not reveal at that time how many customers were affected or what types of data were compromised.
A CenterPoint spokesperson said Wednesday, Oct. 14, that the company "continues to actively investigate the cybersecurity incident disclosed last month." The spokesperson said CenterPoint engaged external cybersecurity, forensic and legal advisors and is working to determine which customers will receive notifications "in accordance with applicable legal requirements."
The company said its electric and gas delivery services have not been disrupted.
The Houston Chronicle reported that five customers across multiple states filed proposed class action lawsuits against CenterPoint in the Southern District of Texas. Three of those lawsuits, filed by Florida law firm Shamis and Gentile, alleged that the company's guest bill pay feature was the vulnerability that allowed unauthorized access.
The feature allows customers to pay using an account number but also retrieves personal information when the correct number is entered, the lawsuits alleged. The lawsuit filed on behalf of Latoya Wyche, a Texas customer, stated that CenterPoint "had the resources necessary to prevent the Data Breach but neglected to adequately invest in security measures …."
The lawsuits placed the date of the breach between Aug. 17 and Sept. 1. None of the proposed classes have been certified.
Under Texas law, businesses must report breaches affecting at least 250 Texans to the attorney general within 30 days of discovering the breach. Affected consumers must be notified within 60 days.
Tech Insider reported that the combination of billing data, driver's license numbers and partial Social Security numbers in the breach makes customers vulnerable to identity-theft and phishing schemes. Residents who believe their information was exposed can place a fraud alert or credit freeze with the three major credit bureaus: Equifax, Experian and TransUnion.
