CenterPoint Energy confirms customer data stolen in cyberattack

CenterPoint Energy confirmed a data breach in which an unauthorized actor exfiltrated personal information of a portion of its customers through an external-facing system. A threat actor using the alias '4d722e4d656f77' claimed responsibility, stating they extracted 7.49 million records containing names, phone numbers, addresses, account numbers, billing amounts, and partial Social Security numbers by exploiting inadequate security controls on the company's public API, including lack of rate limiting and WAF protection. The company has launched an investigation, engaged third-party experts, and reported the incident to authorities, while confirming that utility services were unaffected.

AI-extracted · verify before operational use