CenterPoint Energy has notified Texan authorities that the personal information of over 1 million individuals was compromised in a data breach.
The notice came one month after the Houston-based public utility told the SEC that customer information had been stolen from its systems.
Just days before its initial disclosure, a hacker boasted on a known cybercrime forum that it had obtained nearly 7.5 million user records from CenterPoint Energy.
In its SEC filing, the company confirmed it learned of the data breach after the threat actor’s public post, noting that only a portion of its customers had been affected and that the incident did not impact its operations.
This week, CenterPoint Energy told the Texas Attorney General’s Office that 1,062,060 state residents were affected. It appears that the utility has not sent notification letters to the impacted individuals.
According to the company’s filing, the compromised information includes names, addresses, Social Security numbers, and driver’s license numbers.
CenterPoint Energy also delivers electricity and natural gas to customers in Indiana, Minnesota, and Ohio, and residents of those states might have been affected as well. However, the total impact from the incident remains unclear.
On September 12, the hacker made a 2.5-gigabyte archive available for download, allegedly containing data exfiltrated from the utility. The file seemingly contains approximately 3 million phone numbers along with additional personal information.
SecurityWeek has emailed CenterPoint Energy for clarification on how many individuals were impacted and will update this article if the company responds.
Related: Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach
Related: iRhythm Data Breach Impacts at Least 360,000 People
Related: Oracle Health Data Breach Tally Climbs to Nearly 20 Million
Related: Georgia Power, Alabama Power Data Breach Hits 400,000 Accounts
