Houston-based public utility **CenterPoint Energy**, serving approximately 7 million metered customers across Indiana, Minnesota, Ohio, and Texas, has disclosed a data breach compromising a portion of its customer's personal information. The incident came to light after a threat actor, operating under the alias "**4d722e4d656f77**," publicly claimed to have stolen 7.49 million customer records from the company. ### The Alleged Attack Vector According to the threat actor, the data exfiltration was achieved by iterating through millions of IDs on **CenterPoint Energy**'s public API. The attacker claimed this API lacked critical security measures, including rate limiting, **Web Application Firewall (WAF)** protection, and other safeguards against automated access. ### Compromised Data and Company Response The stolen data allegedly includes names, phone numbers, service and billing addresses, account numbers, billing amounts, and partial Social Security numbers (**SSNs**). In a filing with the **U.S. Securities and Exchange Commission (SEC)**, **CenterPoint Energy** confirmed that an unauthorized third party obtained personal information from one of its external-facing systems. However, the company's filing did not specify the threat actor, the exact number of affected customers, or the precise types of compromised data. **CenterPoint Energy** stated it is working with third-party experts to determine the full scope of the incident and intends to notify affected customers and regulatory authorities as required by law. The company has activated its incident-response procedures, strengthened system protections, and reported the incident to law enforcement and regulators. ### Operational Impact and Legal Repercussions **CenterPoint Energy** has assured that its electric and gas services were not impacted by the cyberattack and does not believe the incident will materially affect its business or financial condition. Despite this, multiple class-action lawsuits have already been filed in federal courts against the company, alleging the data breach occurred between August 17 and September 1.