HOUSTON, Texas. CenterPoint Energy has confirmed that an unauthorized person gained access to personal information belonging to some of its customers, turning earlier reports of a possible cyberattack into a confirmed data breach.
The Houston-based utility disclosed the incident in a filing with the U.S. Securities and Exchange Commission on Sept. 14. CenterPoint said it learned earlier this month about an online post from a third party claiming to have a collection of customer information. The company then activated its cybersecurity response plan and brought in outside cybersecurity experts to investigate.
CenterPoint said its investigation found that an unauthorized third party obtained personal information belonging to a portion of its customers through an “external facing system.” The company has not yet said exactly how many customers were affected or released a complete list of the information that was taken.
The good news for Houston-area residents is that the cyber incident has not affected CenterPoint’s ability to deliver electricity or natural gas. The company said its utility operations remain running normally. CenterPoint also told federal regulators that it does not currently expect the breach to have a major effect on its overall financial condition.
That distinction is important in Greater Houston, where CenterPoint operates much of the electric transmission and distribution system. At the end of 2025, CenterPoint’s Houston Electric service area included about 2.86 million metered residential and commercial customers.
Exactly what information was stolen remains one of the biggest unanswered questions.
Several proposed class action lawsuits filed against CenterPoint claim the exposed information may include customer names, telephone numbers, addresses and billing information. Some lawsuits also claim Social Security information was involved. Those details are allegations made in court filings and have not all been confirmed by CenterPoint.
Some of the lawsuits claim millions of records may have been accessed. One lawsuit reportedly places the number at about 7 million records, while another estimates about 6.7 million affected customers. Other online reports have claimed even larger numbers. CenterPoint has not confirmed those figures, and the number of stolen records would not necessarily equal the number of individual people affected.
Several lawsuits focus on CenterPoint’s online guest bill payment system. The plaintiffs claim the system could return personal customer information after someone entered a valid account number. They argue that this created a weakness that could be used to gather customer information. CenterPoint has not publicly confirmed that the guest payment system was how the attacker gained access.
At least five customers from Texas, Indiana and Minnesota have filed proposed class action lawsuits in federal court over the incident. The lawsuits accuse CenterPoint of failing to use strong enough security protections and argue that customers could now face a greater risk of identity theft. These claims have not been decided in court, and the lawsuits have not yet been approved to move forward as class actions.
CenterPoint has declined to discuss the lawsuits in detail. A company spokesperson told Reuters that its SEC filing “speaks for itself.” The company has also said it generally does not comment on pending litigation.
CenterPoint said it has reported the incident to law enforcement and notified certain regulators. The company also plans to contact customers whose information is confirmed to have been affected when required by law. Investigators are still working to determine the full size of the breach and exactly what personal information was taken.
The company expects to spend money responding to the incident, but said it carries cybersecurity insurance that should help cover some of those costs.
For customers, the biggest concern may be what happens to the stolen information next. Personal information from data breaches can sometimes be used for identity theft or convincing phishing scams. A criminal who already knows a customer’s name, address or utility information may be able to make a fake email, phone call or text message appear more believable.
The Federal Trade Commission recommends that people affected by a data breach watch their financial accounts and credit reports for activity they do not recognize. Consumers can also place a free credit freeze or fraud alert if sensitive identity information may have been exposed. The FTC warns people not to give personal information to someone who unexpectedly calls, emails or sends a text message claiming to represent a company.
CenterPoint has not announced that customers need to change passwords because of the breach, and there is currently no confirmed evidence that CenterPoint account passwords or complete payment card information were stolen.
For now, customers should be especially careful with messages claiming to be from CenterPoint. A data breach can create an opportunity for scammers even if they were not responsible for the original attack. Customers who receive unexpected requests for payment or personal information should contact CenterPoint through a known company website or the telephone number printed on their regular bill rather than using a link or phone number included in an unexpected message. The FTC recommends the same approach when dealing with suspicious emails and text messages.
The investigation is still underway, meaning the number of affected customers and the types of information exposed could change as investigators learn more. CenterPoint says it will notify affected customers and government agencies as required once the company determines the scope of the breach.
