More Than 1 Million Texans Caught Up in CenterPoint Energy Breach, With Social Security Numbers Among the Data
Houston-based utility CenterPoint Energy has told the Texas Attorney General that 1,062,060 state residents were affected by a data breach that exposed names, addresses, Social Security numbers and driver’s license numbers. Here is how the story developed and what it means for businesses that hold customer data.
For a month, CenterPoint Energy customers knew only that something had gone wrong. This week, a state filing put a number on it. The Houston-based utility has reported to the Texas Attorney General’s Office that 1,062,060 Texans were affected by a data breach, and that the exposed information includes names, addresses, Social Security numbers and driver’s license numbers.
We pieced the story together from Ionut Arghire’s report in SecurityWeek and local coverage by KPRC Click2Houston and ABC13 Houston.
It began with a boast
CenterPoint did not discover the problem on its own. According to SecurityWeek, a hacker posted on a known cybercrime forum claiming to have nearly 7.5 million user records from the company. On September 12, the hacker offered a 2.5-gigabyte archive for download that allegedly came from the utility and appears to contain roughly 3 million phone numbers along with other personal information. Those figures are the hacker’s claims and have not been confirmed by CenterPoint.
On September 14, CenterPoint disclosed the incident in a filing with the U.S. Securities and Exchange Commission. It said it had learned of an online post by a third party claiming to hold a dataset of customer information, that it had activated its incident response and hired outside experts, and that only a portion of customers were affected. It did not say how many, or what kinds of information were involved, and it said operations were not affected.
The number arrives
The Texas Attorney General’s breach database, published early this week, filled in some of the blanks: just over a million Texas residents, and some of the most sensitive identifiers a person has. The report also indicates that affected customers had not yet been notified when it was filed, and the state notes the figures may be updated later.
Texas is not the whole picture. CenterPoint also delivers electricity and natural gas in Indiana, Minnesota and Ohio, and SecurityWeek notes that residents there may have been affected too. The total number of people involved remains unclear.
What the company says now
In a statement on Wednesday, CenterPoint said it is still actively investigating with outside cybersecurity, forensic and legal advisors, and is working to determine which customers will receive notifications under applicable legal requirements. It stressed that electric and gas service has not been disrupted.
Under Texas law, KPRC notes, organizations must report a breach affecting at least 250 Texans to the attorney general no later than 30 days after discovering it, and generally must notify affected consumers no later than 60 days after determining a breach occurred.
What this means for your company
If you are a CenterPoint customer, watch for a notification letter, consider freezing your credit with the three bureaus, and be wary of calls, texts or emails that reference your utility account, since criminals often use breach news as cover for scams.
If you run a business that stores customer or employee Social Security numbers, driver’s license numbers or similar data, this case is a useful rehearsal:
- Know which systems hold sensitive identifiers, and keep less of it. Data you do not store cannot be stolen.
- Watch for your name in criminal forums. CenterPoint learned of its breach from a hacker’s post. Dark web monitoring can give you the same early warning before the press does.
- Know your notification deadlines in advance. Many states, including Texas, set specific timelines, and multi-state businesses face several at once. Your incident response plan should list them and name who handles legal notice.
- Rehearse the customer message. Customers judge a company by how quickly and clearly it explains what happened and what to do next.
Need help preparing for a breach before a criminal forum post forces the issue? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
