CenterPoint Energy Data Breach Exposes Personal Data of Over 1 Million Texas Residents
What Happened — CenterPoint Energy disclosed that an unauthorized third‑party accessed an external‑facing API and extracted personal information—including names, addresses, Social Security numbers and driver‑license numbers—of 1,062,060 Texas customers. The breach was first hinted at by a hacker forum post on September 12, 2026, and later confirmed in a Form 8‑K filing.
Why It Matters for Trust & Control Assurance
- The incident highlights a gap in access‑control and authentication for external APIs—a control area that continuous‑monitoring programs are built to verify and evidence.
- Demonstrating that APIs enforce strong authentication, rate‑limiting, and Web‑Application‑Firewall (WAF) protections provides a defensible audit trail across multiple frameworks (e.g., NIST CSF 2.0).
- Leveraging Verisq’s Access Controls capability lets you collect, map, and continuously validate the same evidence that regulators and auditors expect.
Who Is Affected – Energy & utilities operators that expose customer‑facing APIs; any organization handling personally identifiable information (PII) at scale.
Recommended Actions
- Inventory every external‑facing API and verify that authentication, rate‑limiting, and WAF controls are enforced.
- Capture remediation evidence (configuration snapshots, test results, log excerpts) for audit readiness.
- Integrate automated monitoring to alert on anomalous data‑exfiltration patterns.
Source: Security Affairs
Technical Notes
- Attack vector: API exposure lacking proper authentication, rate‑limiting, and WAF protection.
- Data types stolen: names, phone numbers, service/billing addresses, account numbers, billing amounts, payment status, partial SSNs, driver‑license numbers.
- No ransomware or extortion reported; the threat actor offered the data for download.