The Texas AG’s data security breach database now carries the CenterPoint entry (per KPRC Click2Houston and ABC13 Houston, which both reported it on Oct 14). The listing says affected consumers had not been notified yet when the report was submitted, and the state notes that the count and notice status can be updated later. Published tallies of the exact figure don’t match, so we’re using the floor both reports support: more than 1 million.
What changed since September. CenterPoint’s Form 8-K dated Sep 14 said a third party posted online claiming to hold a customer dataset, and that an unauthorized party got personal information for “a portion of its customers” through one of its external-facing systems. The filing gave no victim count and no list of data fields. The Texas filing gives both, at least for Texas residents. CenterPoint also serves customers outside Texas, so the total may be higher.
What the company says now. A CenterPoint spokesperson told KPRC and ABC13 on Oct 14 that the investigation is ongoing with outside cybersecurity, forensic and legal advisors, that the company is still working out which customers will get notices, and that electric and gas service hasn’t been affected.
Still unconfirmed. An actor posting as “4d722e4d656f77” claimed in September to have about 7.49 million records pulled from a company API with weak authentication and rate limits (per CyberInsider’s summary of the post). CenterPoint hasn’t confirmed that count or that access path. Root cause: Undisclosed. Dwell time: Undisclosed.
The clock. Texas law requires a report to the AG within 30 days of finding a breach that affects at least 250 Texans, and consumer notice no later than 60 days after the company determines a breach occurred. Expect letters soon, and a fresh wave of phishing that pretends to be those letters.
What we’d do tomorrow morning. If you run fraud or identity proofing, a set of SSNs, license numbers and service addresses from one metro area is exactly what synthetic and new-account fraud needs. Tighten step-up checks for Houston-area applicants, and stop treating a utility bill as proof of address by itself. If you run a customer portal, go look at your own account lookup and billing APIs: object-level authorization on every call, rate limits per account and per token, and alerts on lookups that walk through sequential account numbers. That’s the access path the actor claims here, and it’s a common one.