A CenterPoint data breach affected 1,062,060 Texas residents, according to a state disclosure published October 13, 2026. The Houston-based utility confirmed unauthorized access to customer information in September. Newly reported details identify the types of personal records involved, while questions remain about individual notifications and the full scope of the incident.
Key Takeaways
- Texas records list 1,062,060 residents affected by the CenterPoint Energy data breach
- The information involved includes names, addresses, Social Security number information, and driver’s license numbers
- CenterPoint first publicly acknowledged the cybersecurity incident in a September 14, 2026, federal filing
- The state’s October 13 disclosure indicated that affected consumers had not yet received notifications at the time of reporting
- CenterPoint said its electricity and natural gas services remained operational and unaffected
CenterPoint Data Breach Exposes Personal Information of Texas Customers
More than one million Texas residents were affected by a data breach involving CenterPoint Energy, according to records released by the Texas Attorney General’s Office on October 13.
The filing identifies 1,062,060 affected Texans, establishing a statewide count that was absent from CenterPoint’s initial announcement in September.
The reported information categories include names, residential addresses, Social Security number information, and driver’s license numbers. These records contain identifying details that can be relevant to identity verification and financial account security.
However, the public disclosure does not specify whether every affected individual had information exposed in all four categories.
The Texas Attorney General’s database identifies the number of affected residents rather than providing a city-by-city breakdown. Consequently, the records do not establish how many customers in Houston, Harris County, or other Texas communities were individually affected.
CenterPoint is headquartered in Houston and provides electric transmission and distribution services across the Houston area. The company also operates natural gas utilities in Texas and other states.
The October disclosure offers a more detailed account of the incident than the company’s earlier federal filing. However, the state notes that reported figures and consumer notification information may change when businesses submit updates.
CenterPoint Confirmed Unauthorized Access in September
CenterPoint first publicly acknowledged the cybersecurity incident on September 14, 2026, in a filing with the U.S. Securities and Exchange Commission.
The company reported becoming aware of an online post in which a third party claimed to possess a dataset containing customer information.
CenterPoint said it activated cybersecurity response procedures, began an investigation with outside specialists, and took additional measures to protect its systems.
The company subsequently determined that an unauthorized third party had obtained personal information associated with some customers through an external-facing system.
The September filing did not identify the number of affected individuals or provide the specific categories of exposed information later reported to Texas authorities.
CenterPoint also disclosed that it had contacted law enforcement and notified certain regulatory authorities.
In a statement provided to Houston television station KPRC on October 14, the company said it continued working with cybersecurity, forensic, and legal advisers to determine the scope of affected customer information.
The utility maintained that electricity and natural gas delivery remained uninterrupted.
The incident comes amid broader cybersecurity concerns across Texas energy industries. A separate Texas energy cybersecurity warning issued in September addressed threats involving operational technology and industrial control systems.
That warning concerned different security risks and does not establish a connection to the CenterPoint incident.
CenterPoint’s public disclosures concern unauthorized access to personal information rather than a reported disruption to power delivery or natural gas operations.
Customer Notification Status Remains a Central Concern
The October 13 Texas disclosure indicated that affected residents had not yet been notified when the information was reported to state authorities.
The state’s breach reporting system allows organizations to update the number of affected individuals and the status of consumer notifications.
On October 14, CenterPoint said its investigation remained active and that it was working to identify customers who would receive notifications under applicable legal requirements.
Texas law requires businesses experiencing qualifying data breaches affecting at least 250 state residents to report the incidents to the attorney general as soon as practicable and no later than 30 days after discovery.
Organizations must also notify affected consumers in accordance with applicable requirements.
The state’s initial notification status does not independently establish that CenterPoint violated those requirements. Determining compliance requires additional information about the applicable reporting dates, circumstances, and notification obligations.
Personal Information Raises Identity Security Considerations
The Federal Trade Commission recommends that individuals whose Social Security numbers may have been exposed review their credit reports for unfamiliar accounts or activity.
Consumers can also consider credit freezes or fraud alerts. A credit freeze restricts access to credit reports when new accounts are requested, while a fraud alert requires additional identity verification by potential creditors.
Both measures are available without a fee.
CenterPoint separately maintains consumer guidance addressing utility impersonation scams, including unexpected payment requests and threats of immediate service disconnection.
The company advises customers to verify suspicious communications through established customer-service channels instead of relying on telephone numbers supplied by unexpected callers.
Broader concerns involving consumer impersonation scam tactics have also appeared in cybersecurity discussions. However, the available CenterPoint disclosures do not establish that identity theft, fraudulent account activity, or impersonation schemes resulted from this particular breach.
The confirmed findings remain limited to unauthorized access, the information categories reported, and the number of Texas residents identified in the state disclosure.
Frequently Asked Questions
How many Texans were affected by the CenterPoint data breach?
The CenterPoint data breach affected 1,062,060 Texas residents, according to the October 13, 2026, disclosure published by the Texas Attorney General’s Office. The state notes that reported numbers may change if additional information becomes available.
What personal information was involved in the CenterPoint Energy breach?
The state’s records identify names, addresses, Social Security number information, and driver’s license numbers among the affected information categories. The disclosure does not specify whether every affected person had all those details exposed.
Has CenterPoint notified customers about the data breach?
The October 13 state disclosure indicated that affected consumers had not yet been notified at the time of reporting. On October 14, CenterPoint said it was continuing to identify customers who would receive notices under applicable requirements.
Did the CenterPoint data breach interrupt electricity or gas service?
CenterPoint stated that its electricity and natural gas delivery operations were not affected by the cybersecurity incident. The company’s disclosures concern unauthorized access to customer information rather than an interruption of utility services.
What precautions can affected customers consider?
The Federal Trade Commission recommends reviewing credit reports and considering free credit freezes or fraud alerts when sensitive identifying information may have been exposed. CenterPoint also advises customers to verify unexpected utility communications through official service channels.
