CenterPoint Confirms Customer Data Theft as Hacker Claims 7.49 Million Records Stolen
Updated
Updated · Fox News · Sep 25
CenterPoint Confirms Customer Data Theft as Hacker Claims 7.49 Million Records Stolen
2 articles · Updated · Fox News · Sep 25
Summary
CenterPoint disclosed in a Sept. 14 SEC filing that an unauthorized third party obtained some customer personal information through an external-facing system, though the utility has not said how many customers were affected.
7.49 million records were claimed by a hacker using the alias 4d722e4d656f77, who said the haul included names, phone numbers, service and billing addresses, account numbers, billing amounts and partial Social Security numbers.
A public API was allegedly used to cycle through millions of IDs because protections such as rate limiting and a web application firewall were missing, but CenterPoint has not confirmed that attack method.
Electric and natural gas service remained operational, and CenterPoint said it does not expect a material financial impact while it investigates and prepares required customer and regulator notifications.
Utility-account data can fuel convincing shutoff, payment and account-verification scams, making fake CenterPoint calls, texts and emails the most immediate risk even before the breach's full scope is known.