CenterPoint Energy data breach exposes Social Security numbers of over 1 million Texans

Houston-based utility CenterPoint Energy has reported that a data breach affected more than one million people in Texas, according to SecurityWeek. In a filing with the Texas Attorney General's Office, the company said 1,062,060 Texas residents were impacted by the theft of customer information that includes Social Security numbers and driver's license numbers. The disclosure gives the first concrete figure for an incident that came to light after a hacker advertised the stolen data on a cybercrime forum.

What happened

SecurityWeek reports that CenterPoint, which delivers electricity and natural gas in Texas, Indiana, Minnesota and Ohio, previously told the U.S. Securities and Exchange Commission that customer information had been stolen from its systems. The company said it learned of the breach after the attacker publicly posted about it, that only a portion of its customers were affected, and that its operations were not impacted.

According to the report, days before CenterPoint's initial disclosure, the hacker claimed on a known cybercrime forum to have obtained nearly 7.5 million user records. On September 12, the attacker made a 2.5-gigabyte archive available for download that allegedly contained roughly 3 million phone numbers and other personal information. These claims have not been independently verified, and the attacker has not been publicly identified.

About a month after the SEC disclosure, CenterPoint notified Texas authorities, and the number of affected residents was published this week.

Who is affected

The data exposed for affected customers includes names, addresses, Social Security numbers and driver's license numbers, SecurityWeek said. The total number of people affected in Indiana, Minnesota and Ohio remains unclear, and the report suggests the company has not yet sent notification letters to affected individuals. SecurityWeek said it had asked CenterPoint for clarification on the overall number of people affected.

The combination of Social Security and driver's license numbers with names and addresses is particularly valuable to fraudsters, as it can be used for identity theft, opening fraudulent accounts and convincing social engineering attempts.

What to do

CenterPoint customers, particularly in Texas, should watch for the company's official notification letters and be wary of calls, texts or emails claiming to come from the utility, especially those requesting payment or personal details. Affected individuals can consider placing a credit freeze or fraud alert with the major U.S. credit bureaus, review credit reports for unfamiliar accounts, and enable additional verification on utility, banking and government accounts where available.