CenterPoint Energy Data Breach

CenterPoint Energy told federal regulators this month that an unauthorized third party obtained customer personal information through one of its own systems. The company says it plans to notify affected customers, but as of this writing, individual notice letters have not been sent.

CenterPoint Energy, Inc., a Texas-based utility holding company serving millions of electric and natural gas customers across several states, disclosed a cybersecurity incident in a filing with the U.S. Securities and Exchange Commission on September 14, 2026. In its own words, the company:

“has determined that an unauthorized third party obtained personal information relating to a portion of the Company’s customers through one of the Company’s external facing systems.”

According to the filing, CenterPoint became aware in September 2026 of a third party’s online post claiming to have a dataset of customer information. The company reported the incident to law enforcement, has notified certain regulators, and states that it intends to notify affected customers. As of this writing, individual notice letters have not gone out.

What Information May Be Involved?

CenterPoint’s own SEC filing describes the exposed data only as “personal information” without itemizing specific categories. Separately, cybersecurity researchers analyzing the incident have reported that the exposed data may include customer names, phone numbers, service and billing addresses, account information, premise IDs, billing amounts, payment status, service details, autopay and paperless billing status, and partial Social Security numbers, and that the underlying dataset may include roughly 7.49 million raw records. CenterPoint itself has not confirmed this figure or breakdown, and Emery | Reddy is presenting it here as third-party analysis, not as a confirmed fact from the company.

Why This Matters Now, Before Notices Go Out

An SEC filing is notice to investors, not to customers. CenterPoint has acknowledged unauthorized access to customer data in a public regulatory filing, but individuals whose information may have been involved have not yet received a notice letter explaining what happened or what to do. Emery | Reddy is monitoring this case and gathering information from CenterPoint customers now, so that we are ready to act as soon as individual notice is issued and the scope becomes clearer.

Do You Have Legal Options?

Utilities that store customer account and billing information have a legal duty to safeguard it. If CenterPoint confirms that your information was involved once notice goes out, you may have rights and remedies under applicable law.

If you are a CenterPoint Energy customer and want to be added to our list ahead of formal notice, or if you have already received a notice, contact the Data Breach Attorneys at Emery | Reddy.

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Utility companies are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Frequently Asked Questions

Has CenterPoint Energy sent notice letters yet?

Not as of this writing. CenterPoint disclosed the incident to the SEC and reported it to law enforcement and certain regulators, and has stated it intends to notify affected customers, but individual notice letters have not gone out yet.

How many people were affected?

CenterPoint has not confirmed a population figure. Third-party cybersecurity researchers have reported a dataset of roughly 7.49 million raw records, but that number has not been confirmed by CenterPoint itself.

What happened?

CenterPoint states that an unauthorized third party obtained personal information relating to a portion of its customers through one of the company’s external facing systems. The company became aware in September 2026 after a third party posted online claiming to have a customer dataset.

What information was exposed?

CenterPoint’s own filing describes the data only as “personal information.” Independent researchers have reported that names, contact and billing information, account and premise details, and partial Social Security numbers may be involved, but this has not been confirmed by the company.

I’m a CenterPoint customer and haven’t received anything. Should I still reach out?

Yes. Because individual notice has not gone out yet, reaching out now helps us track your case and be ready to act as soon as CenterPoint confirms who was affected.

Do I have a legal claim?

You may, once CenterPoint confirms whether your information was involved. Utilities are required by law to safeguard customer data. Contact the Data Breach Attorneys at Emery | Reddy at 916.995.5968 or www.emeryreddy.com for a Free Case Review. No Fee Unless We Recover.