CenterPoint Energy data breach: customer data taken through an external-facing system

What happened in the CenterPoint Energy breach?

CenterPoint says it learned of the incident in September 2026 from an online post by a third party claiming to have a data set containing some of its customer information. It activated its incident response protocols, began an investigation with outside cybersecurity experts and reported the matter to law enforcement.

The company filed under Item 8.01, other events, rather than Item 1.05, and said it did not then believe a material impact on its finances was reasonably likely. The Item 8.01 versus Item 1.05 guide explains that choice, and the vendor and cloud tenant guide compares other filings that name an internet-facing entry point.

Date	What the filings and Texas's list say
August 19, 2026	Date of breach on Texas's list
September 2026	CenterPoint becomes aware of an online post claiming to hold its customer data
September 14, 2026	Form 8-K, Item 8.01
October 27, 2026	Quarterly report on Form 10-Q filed
October 28, 2026	Posted on the Texas attorney general's list, 970,891 Texans

The 8-K does not give the date of the intrusion or of the post, and says nothing about a ransom; Texas's list gives August 19, 2026 as the date of breach.

What information was involved?

The 8-K says only that personal information relating to a portion of customers was obtained, and that CenterPoint was still working out which customers and which information. Texas's list, posted six weeks later, names names, addresses, Social Security numbers and driver's license numbers.

Was power or gas service affected?

No. The 8-K says electric and gas delivery was not affected and remained operational.

How many people were affected?

Texas is the only regulator list fetched for this page that records the breach: 970,891 Texans, the sixth largest count on its 2026 list. CenterPoint's 8-K gives no total. The breach is in the Texas ranking.

What does CenterPoint say about costs?

It says it has incurred and expects to keep incurring expenses from the incident, and that its cybersecurity insurance should offset related costs. Its quarterly report for the period ended September 30, 2026, filed on October 27, mentions cyber intrusions and data security breaches only in its general list of risk factors, not as a described event. The guide to shutdowns and costs in 8-K filings shows what other filers later reported about insurance.

What the documents leave open

• Which external-facing system was used, and when.
• Who posted the claim, and whether the data has been published in full.
• How many customers outside Texas are affected; no other state list fetched for this page records the breach.
• What CenterPoint is offering customers; no notice letter was found on the California, Washington, Massachusetts or Indiana lists.

Was my Social Security number exposed in the CenterPoint breach?

Texas's list includes Social Security numbers for this breach. CenterPoint said it would notify affected customers; the notice you receive should say what applies to you.