CenterPoint Energy data breach: what to do now

What happened

In September 2026, CenterPoint told the Securities and Exchange Commission that an unauthorized third party had obtained personal information about a portion of its customers through an external-facing system. The company says it learned of the breach from an online post by someone claiming to have a set of its customer data. It brought in outside cybersecurity experts, notified law enforcement, and says electric and gas service wasn't affected.

In October 2026, CenterPoint told the Texas Attorney General's Office that 1,062,060 Texans were affected. The hacker had claimed about 7.5 million records, a figure the company hasn't confirmed. CenterPoint also serves customers in Indiana, Minnesota, and Ohio, and hasn't said whether people there were affected.

As of mid-October, news reports said notification letters didn't appear to have gone out yet, and no credit monitoring offer had been announced. We'll update this page when that changes.

What information was exposed

• Name
• Address
• Social Security number
• Driver's license number

This list comes from CenterPoint's filing with the Texas Attorney General. Your letter, when it arrives, should say which items involved you.

What to do now

1. Freeze your credit at Equifax, Experian, and TransUnion. It is free, stops anyone from opening new credit in your name, and you can lift it when you need to apply for something.
2. Watch for utility scams. A common one is a call or text saying your power or gas will be shut off unless you pay right away. With real customer data, these will sound more convincing. Utilities generally don't demand immediate payment by gift card, cryptocurrency, or payment app. Hang up and call the number on your bill.
3. Check your free credit reports at AnnualCreditReport.com for accounts you didn't open.
4. When your letter arrives, enroll in any free credit monitoring CenterPoint offers, using only the link or phone number in the letter. Scammers often set up fake enrollment sites after big breaches.
5. Because your driver's license number was exposed, watch for signs of misuse, such as tickets, accounts, or mail tied to your license that you don't recognize.

Ask CenterPoint to delete your data

If you're a current customer, CenterPoint needs some of your information to provide service and bill you, and utilities must keep certain records. If you've moved out of CenterPoint's area, you can ask it to delete what it no longer needs, and current customers can ask whether it still needs to keep sensitive details like your Social Security number. Texas's privacy law gives Texans the right to request deletion from covered companies.

Your legal right to deletion

Texas and many other states, including Minnesota, give residents the right to ask covered companies to delete their personal data, and companies generally must respond within the deadline the state sets, except for records they're required to keep. See what your state's law requires.

Sources: SecurityWeek and FOX 26 Houston, reporting on CenterPoint's SEC filing and Texas Attorney General notice. DataTrail isn't affiliated with CenterPoint Energy. This page is general information, not legal advice.