CenterPoint Energy Alerts Regulators After Customer Data Appears on Dark Web

Houston-based utility CenterPoint Energy has informed federal regulators that a portion of its customer information was discovered on a dark‑web marketplace, prompting the company to issue a public warning about a potential data breach.

The utility, which provides electricity and natural gas to millions of residents in Texas, said the exposure was uncovered after an anonymous post on a hidden internet forum listed what appeared to be personal data linked to its customers. CenterPoint’s security team traced the leak to that online source and promptly reported the incident to the Department of Energy and the Federal Trade Commission.

According to the company’s statement, the compromised data set includes names, addresses, account numbers and, in some cases, billing details. No evidence has yet emerged that financial information such as credit card numbers or Social Security numbers was part of the leak, but the utility cautioned that the information could be used for phishing or identity‑theft schemes.

CenterPoint Energy emphasized that its internal investigations are ongoing and that it is working with cybersecurity experts to determine how the data was extracted. The firm noted that its network monitoring tools had not detected any unauthorized access to its core systems, suggesting that the breach may have resulted from a third‑party vendor or a phishing attack on an employee.

Regulatory bodies have begun reviewing the incident to assess whether CenterPoint complied with data‑protection requirements under federal law and state statutes. The utility’s prompt notification aligns with the breach‑notification provisions of the Federal Trade Commission’s Safeguards Rule, which mandates timely reporting of compromised consumer information.

Customers who receive a notice from CenterPoint are advised to monitor their accounts for suspicious activity and consider enrolling in credit‑monitoring services. The utility also said it will provide free identity‑theft protection for affected individuals, although it has not disclosed the exact number of customers impacted. The case underscores the growing challenge utilities face in safeguarding sensitive data amid an expanding cyber‑threat landscape.