CenterPoint Energy confirmed a data breach in an SEC Form 8-K filing on September 15, 2026, after a hacker posted stolen customer data on a dark web forum. The attacker, using the alias “4d722e4d656f77,” claims to have extracted 7.49 million customer records, including names, addresses, account numbers, billing information, and partial Social Security numbers, through an unsecured external-facing API. CenterPoint has not confirmed the exact figure or every data field. Energy services were not disrupted. Customer notification is pending the scope investigation.
CenterPoint Energy, a Houston-based electric and gas utility serving around 7 million customers across Texas, Indiana, Minnesota, and Ohio, filed an emergency disclosure with the Securities and Exchange Commission on September 15, 2026, confirming the breach. The company said it became aware of the incident after seeing an online post by a third party claiming to have stolen its customer data.
What Actually Happened
The hacker didn’t break through a firewall or deploy complex malware. According to the post on the cybercrime forum, they found an external-facing API, a programmatic entry point that software uses to communicate with CenterPoint’s systems, that had almost no security protecting it.
The post described the API as lacking Web Application Firewall (WAF) protection, rate limiting, certificate authentication, and any form of JWT token verification. In plain terms: the door was open, and the alarm was off.
The attacker claimed to have been extracting data continuously until CenterPoint noticed and tried to shut the access down mid-extraction. The hacker said they bypassed that attempt with what they called “a simple CAPTCHA key” and kept pulling records. By the time the connection was severed, they claimed they had extracted 7.49 million records.
The hacker’s own post cites an even larger figure: CenterPoint had a data pool of 17.44 million records that could have been fully pulled had the attack not been partially interrupted.
CenterPoint has not independently verified or confirmed any of those specific numbers. The company’s SEC filing describes the breach simply as an “unauthorised third party” obtaining customer data “through one of the Company’s external-facing systems.”
Who the Hacker Is
The threat actor posted under the alias “4d722e4d656f77”, a hexadecimal-encoded string that, when decoded, reads “Mr Meow.” Dark web monitoring account @DailyDarkWeb flagged the post, the same platform that picked up the ValueFirst dark web alert in India earlier this year, where a similar monitoring flag gave early warning of potential infrastructure exposure.
The hacker also posted a direct taunt at CenterPoint in the forum listing: “It’s quite funny to think a $26.2 billion company has WEAK protection.”
The post included a 2.5 GB archive offered for download and a warning that went beyond data theft: “next time we won’t simply pull data, we’ll start attacking the main infrastructure.” CenterPoint is a critical infrastructure operator. CISA takes threats of follow-on infrastructure attacks from dark web actors seriously, regardless of whether they materialise.
What Data Was Allegedly Taken
According to the cybercrime forum post, the dataset contains:
- Full customer names
- Phone numbers
- Service and billing addresses
- Account numbers
- Billing amounts
- Payment status
- Partial Social Security numbers
The hacker described the data as stored in JSONL format across seven files, with a CSV version also available containing filtered PII fields. CenterPoint’s own SEC filing confirms it took personal information but does not specify every field or confirm the total volume.
The combination of account numbers and partial SSNs is the detail worth watching. Utility companies use that pairing in customer identity-verification calls. If someone calls CenterPoint’s support line with your account number and the last four digits of your Social Security number, many IVR systems will treat them as you.
This is the same dynamic that drives the synthetic identity fraud market we covered recently; partial identity documents combined with account context create convincingly targeted fraud, even without a complete SSN.
This Is CenterPoint’s Second Breach in Three Years
This incident doesn’t exist in isolation. In 2023, CenterPoint Energy was among the organisations affected by the mass exploitation of MOVEit, a popular file transfer software. The Cl0p ransomware group exploited a zero-day vulnerability in MOVEit and used it to steal data from hundreds of organisations globally. CenterPoint investigated its exposure and disclosed it at the time.
Three years later, customer data is on a dark web forum again, this time through a misconfigured API rather than a third-party software vulnerability. Two distinct incidents. Two different attack vectors. The same customers affected.
The pattern of repeated exposure through different access points mirrors what we’ve seen with other large organisations in 2026. As our analysis of how early warning signs of breaches surface on the dark web shows, the same organisation appearing twice in the breach record suggests systematic security gaps rather than a single unlucky event.
What CenterPoint’s SEC Filing Actually Says
Companies the size of CenterPoint must disclose material cybersecurity incidents to the SEC. The Form 8-K filed September 15 is the official record of what CenterPoint is prepared to say publicly.
Key points from the SEC filing:
- The company became aware of an online post claiming data theft “in September 2026”
- An investigation confirmed unauthorised access through an external-facing system
- Energy delivery services are not affected
- Customer notification will happen “as required by applicable law”
- Investigation is ongoing with third-party experts
- Law enforcement has been notified
- Financial impact not considered material given the company’s $244 million net income in Q2 2026
What the filing does not include: the total number of affected customers, which specific data fields were taken, or whether the company confirmed or disputes the hacker’s 7.49 million claim.
Why a Utility Breach Hits Differently
Most data breaches expose information that can be used for financial fraud or identity theft at a distance. A utility breach carries a specific additional risk: the data maps directly to where people live.
Service addresses are home addresses. Billing addresses confirm residency. Account status confirms whether someone is currently occupying a property. The combination of name, phone number, and confirmed address helps anyone conducting social engineering or physical targeting. That risk is particularly acute for people whose addresses need to stay private, survivors of domestic violence, individuals under protective orders, or anyone whose safety depends on residential anonymity.
This is the same risk that made the 153 million driver’s licence exposure through IDScan.net so alarming to researchers who flagged it: physical address exposure isn’t just a fraud risk; it’s a safety risk for a non-trivial percentage of affected individuals.
The API Security Problem That Keeps Appearing
What the hacker described is a textbook example of a poorly secured API endpoint, and it’s not the first time this has shown up in 2026 breach reporting.
APIs without rate limiting can be queried at high speed with no throttle. APIs without JWT token validation don’t verify that the requesting party is authorised. APIs without WAF protection have no filters to block malicious traffic patterns. An API with all four of these gaps is essentially a database with a public URL.
This is exactly the kind of external-facing vulnerability that dark web forums trade intelligence about before public disclosure. As supply chain attack monitoring research from earlier this year documented, attackers increasingly probe API weaknesses first. They’re faster to exploit and harder to detect than traditional penetration techniques.
The Sonora government portal breach we covered in August followed similar logic: a publicly accessible configuration file with no authentication, discovered and exploited without any need for sophisticated tools; different sector, identical security gap.
What CenterPoint Customers Should Actually Do
CenterPoint hasn’t notified affected customers yet. The investigation is ongoing. But waiting for official notification isn’t the only option.
Watch your utility bills and account closely. Account numbers are in the alleged dataset. If someone calls your utility provider with your name, account number, and last four digits of your SSN, they can potentially change account settings, redirect service, or update payment details. Turn on any account alert features CenterPoint offers.
Be suspicious of CenterPoint-related calls and emails. The leak includes contact details. A phishing call from someone who knows your account number, name, and address sounds a lot more legitimate than a generic scam call. Don’t give personal information to inbound contacts claiming to be from CenterPoint. If you have concerns, call the official number on your bill.
Check if your email was in previous breaches. At Have I Been Pwned, you can check whether your email address has appeared in confirmed breach databases. If the CenterPoint data is eventually added and verified, you’ll want to set up an alert.
Consider a fraud alert with the credit bureaus. The partial SSN exposure is limited (last four digits), but combining it with name and address still creates risk. A fraud alert at Equifax, Experian, or TransUnion adds a verification step before any new credit is opened in your name. It’s free and doesn’t affect your existing credit.
If you believe identity theft has already occurred, report it to the FTC at IdentityTheft.gov for a personalised recovery plan and official documentation you can use to dispute fraudulent accounts.
Our full guide on what to do when your personal data is exposed on the dark web walks through the complete checklist in the right order.
The Part That Gets Overlooked
Every breach notification article focuses on what data was taken. The part that gets less attention is how long the data was already circulating before the notification.
The dark web post appeared September 12. The SEC filing came September 15. CenterPoint says it became aware “in September 2026”, which could mean the same day the post appeared, or it could mean they were notified after the DailyDarkWeb alert spread. The company hasn’t clarified how they found out.
Between the initial extraction and the public post, data could have been changing hands privately for days, weeks, or longer. By the time a company files with the SEC, the window during which the breach was unknown has already closed. The data is already somewhere.
As we covered when looking at whether stolen data can ever be removed from the dark web, a company locking down its systems after a breach stops new extraction. It doesn’t retrieve what’s already been downloaded.
Frequently Asked Questions
How many CenterPoint Energy customers were affected?
The hacker claims 7.49 million records. CenterPoint’s SEC filing confirms an unauthorised access occurred but has not confirmed a specific number. An investigation is ongoing.
What data was exposed in the CenterPoint Energy breach?
The hacker’s post claims names, phone numbers, service and billing addresses, account numbers, billing amounts, payment status, and partial Social Security numbers. CenterPoint confirmed personal information was accessed but has not specified every field.
Was my electricity or gas service affected?
No. CenterPoint confirmed that electric and gas service delivery was not impacted.
How did the breach happen?
The hacker claims they accessed an external-facing API that lacked basic security controls, including WAF protection, rate limiting, and authentication tokens.
Has CenterPoint notified affected customers yet?
As of September 15-16, 2026, CenterPoint has not sent customer notifications. The company said it intends to notify customers as required by applicable law once the scope investigation is complete.
Is this CenterPoint’s first breach?
No. In 2023, CenterPoint investigated exposure linked to the MOVEit mass-exploitation incident. This is the company’s second confirmed data security incident in approximately three years.
