In a Form 8-K filed with the US Securities and Exchange Commission on 14 September 2026, Houston-based utility CenterPoint Energy said that an unauthorized third party obtained personal information relating to a portion of its customers through one of its external-facing systems; BleepingComputer reported the filing on 15 September.

CenterPoint says electric and gas services were not impacted and does not expect a material business effect; it activated IR, engaged third-party experts, hardened systems, and notified law enforcement/regulators. Class-action complaints filed in US federal courts allege the incident window was about 17 August–1 September 2026.

UPDATE (14 Oct 2026, US time): KPRC 2 Houston reports that a CenterPoint breach report published on the Texas Attorney General's website on Monday (12 October, US time) lists 1,062,060 Texans as affected, gives names, addresses, Social Security information and driver's licence numbers as the information involved, and indicates affected people had not yet been notified when it was submitted.

A CenterPoint spokesperson told KPRC the company is still working with third-party experts to assess the scope of affected customer data and identify which customers will be notified. (source: KPRC 2 Houston (14 Oct), citing the Texas Attorney General)

Correction (26 Oct 2026): removed the threat actor's own claims about how many records it took and how, and its later data release; CenterPoint has not confirmed them and no outlet has independently verified them. (source: BleepingComputer)

Correction (26 Oct 2026): removed every SecurityWeek credit, link and detail; the affected-Texans count, data types and notification status from the Texas Attorney General's breach database are now credited to KPRC 2 Houston (14 Oct), citing the Texas Attorney General. (source: KPRC 2 Houston (14 Oct), citing the Texas Attorney General)

Correction (27 Oct 2026): CenterPoint's SEC Form 8-K is now linked and the company's statements are credited to it directly rather than to BleepingComputer's account of it. (source: CenterPoint Energy Form 8-K, SEC)

Correction (29 Oct 2026): the card date is now 14 September 2026, the date shown on CenterPoint's linked Form 8-K, the earliest source for this story; the filing-acceptance time used for the earlier 15 September date came from an SEC page that is not linked, and it has been removed. Internal source labels were also removed. (source: CenterPoint Energy Form 8-K, SEC)