CenterPoint Energy confirms customer data breach after attacker claims 7.49 million records stolen

Coverage from Bleeping Computer indicates that CenterPoint Energy has confirmed a data breach affecting some of its customers' personal information, following claims by a threat actor who allegedly stole millions of records.

The breach was discovered after an attacker posted online claiming to have obtained 7.49 million customer records, including names, phone numbers, addresses, account numbers, billing amounts, and partial Social Security numbers. The threat actor stated the data was exfiltrated by exploiting vulnerabilities in CenterPoint's public API, specifically a lack of rate limiting and WAF protection. CenterPoint Energy, a major public utility serving millions across Indiana, Minnesota, Ohio, and Texas, confirmed in a filing with the U.S. Securities and Exchange Commission that an unauthorized third party accessed personal information through an external-facing system. While the company is still investigating the full scope, it intends to notify affected customers and regulatory authorities as required.

The utility stated that its electric and gas services were not impacted, and it does not anticipate a material effect on its business or financial condition. The company has engaged cybersecurity experts, enhanced system protections, and reported the incident to law enforcement. Multiple class-action lawsuits have already been filed against CenterPoint Energy by customers alleging the breach occurred between August 17 and September 1.

Source: Bleeping Computer