CenterPoint Energy data breach (September 2026): what CenterPoint confirmed
In September 2026 CenterPoint Energy, a Houston utility, confirmed a customer-data breach after a hacker advertised its data.
Short answer
Was CenterPoint Energy hacked?
Yes. CenterPoint’s Form 8-K of 14 September 2026 says it became aware of a third-party post claiming to hold customer information and confirmed a data breach; energy services were not affected.
A hacker claimed 7.49 million records, which CenterPoint has not verified. A Texas Attorney General listing reported by Security Affairs counts 1,062,060 Texans.
Timeline at a glance
14 Sep 20268-K: customer data breach confirmed; energy services unaffected. (BleepingComputer)Confirmed
Last updated October 31, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
CenterPoint Energy’s security posture at the time
What CenterPoint Energy publicly said about its security certifications and controls, how big it is, and how its shares moved, each tied to a source. A certificate covers a stated scope at a point in time; it is not a guarantee about every system. Reviewed 31 October 2026. Compare all 2026 breaches.
Security certifications publicly held
No public certification found.
No public certification found on the company’s own security, trust or compliance pages, in filings, or in the certificate registries searched (BSI, CSA STAR). That is a data point, not proof that none exists.
Size
Consolidated FY2025 revenue not verified for this page (see the FY2025 10-K)
Listing: NYSE: CNP
Share price around the disclosure
No reliable report of a share-price move around the disclosure was found.
CenterPoint Energy incident timeline, in detail
Confirmed = acknowledged by CenterPoint Energy, a regulator filing or a court. Reported = credible reporting CenterPoint Energy has not fully confirmed. Unverified claim = an attacker or leak-site claim.
14 Sep 2026ConfirmedCustomer data theft
Customer data advertised by a hacker; breach confirmed
What happened. CenterPoint’s Form 8-K says it became aware of a third-party post claiming to hold customer information, confirmed a data breach and said energy services were not affected. A hacker claimed 7.49 million records, which CenterPoint has not verified.
Impact. Energy delivery unaffected; CenterPoint does not expect a material financial impact. People or records affected: 1,062,060 Texas residents, per a Texas Attorney General listing reported by Security Affairs; the hacker claims 7.49 million records.
We found no SOC 2 or ISO 27001 certification published by CenterPoint Energy. That does not prove it had none; it means none was public.
A direct intrusion
The company describes unauthorized access to its own systems. The useful questions are how long the access lasted, how it was detected, and whether the affected system was inside the scope any certification covered.
What it means for CenterPoint Energy CenterPoint customers — and what to do
What CenterPoint Energy’s customers, partners and security teams can do now, based only on what has been disclosed.
1.Ask what was in scope
Ask which systems were reached, what data of yours they held and the dates of access.
Yes. CenterPoint’s Form 8-K of 14 September 2026 says it became aware of a third-party post claiming to hold customer information and confirmed a data breach; energy services were not affected.
Did CenterPoint Energy have SOC 2 or ISO 27001 certification?+
We found no SOC 2 or ISO 27001 certification published by CenterPoint Energy. That does not prove it had none; it means none was public.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by CenterPoint Energy. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.
🎉 New here? Use code WELCOME10 for 10% off any plan at checkout