CenterPoint Energy, the Texas-based electric and gas utility serving 7 million customers across Indiana, Minnesota, Ohio and Texas, disclosed to the Securities and Exchange Commission that hackers obtained personal information from its systems during a recent data breach. In an 8-K filing made on the evening of Monday 15 September, the company said it became aware of a dark-web post this month claiming to offer data stolen from CenterPoint, and that its investigation established hackers had obtained "personal information relating to a portion of the Company's customers through one of the Company's external facing systems". The utility confirmed that delivery of electric and gas services has not been affected, has reported the incident to law enforcement, and says it is working with third-party experts to determine the scope of affected customers and information and will notify customers and regulators as required by applicable law. A company spokesperson declined to answer further questions about the criminal post, which claims roughly 7.5 million records containing customer names, account information, the last four digits of Social Security numbers and billing information. The company says it will incur investigation-related costs but does not expect a material financial impact; it reported net income of $244 million in the second quarter. This is the second time CenterPoint has worked a customer-data incident of this kind — last year it disclosed an investigation into a breach arising from the 2023 MOVEit file-transfer campaign. the victim has disclosed to a regulator and confirmed that customer personal information was taken from its own external-facing system, which makes this a confirmed breach. The scope figure of 7.5 million records, however, is the claimant's number published in the dark-web post, not a figure the company has verified — the victim's own statement describes an undetermined "portion" of customers, and the difference between those two numbers is the whole of the outstanding uncertainty.

• Source article