The incident involved names, addresses, Social Security information and driver’s license numbers. CenterPoint assures that electricity and gas supply were not affected.
Updated October 16, 2026.
A CenterPoint Energy data breach affected 1,062,060 Texas residents and 1,611,625 people in total. Among the categories of information involved are names, addresses, Social Security information and driver’s license numbers.
CenterPoint, based in Houston, confirmed that unauthorized third parties obtained personal information related to a portion of its customers through one of its externally facing systems. The company stated that the incident did not disrupt electricity or gas service.
CenterPoint maintains the electrical infrastructure serving about 2.8 million metered customers in the Houston area. The information available about the breach does not break down how many of the affected individuals live in Houston or Harris County.
The breach affected 1,611,625 people, including 1,062,060 in Texas
The unauthorized access occurred between August 19 and August 22, 2026, and the breach was discovered on September 9, according to information reported in Texas.
CenterPoint filed a notification with the U.S. Securities and Exchange Commission (SEC) on September 14, confirming that it had activated its cyber incident response protocols, initiated an investigation with external specialists, and reported the case to law enforcement and certain regulators.
The investigation remained open at the time of that filing. CenterPoint indicated that it was still working to determine the scope of affected customers and the personal information involved.
Names, addresses, Social Security and licenses are among the data involved
The information reported in Texas identifies four categories of personal information involved:
- name;
- address;
- Social Security number information;
- driver’s license number.
The information available does not establish that the four categories pertain to every affected individual.
CenterPoint has not publicly attributed the access to a specific person or group. The company described it to the SEC as the work of an unauthorized third party.
CenterPoint expects to notify affected customers in accordance with the law
CenterPoint informed the SEC that it expects to notify affected customers and regulatory authorities as required by applicable laws.
Texas data breach law requires notifying affected consumers when the criteria are met and reporting breaches affecting at least 250 Texas residents to the Attorney General.
As of October 16, publicly available information could not establish that individual notifications had reached all Texas residents included in the reported figure.
The FTC recommends checking credit when a Social Security number is exposed
The Federal Trade Commission (FTC) recommends reviewing credit reports to detect accounts that you do not recognize when a Social Security number is exposed in a data breach.
A credit freeze restricts access to the report and makes it harder to open new accounts. Placing and lifting it is free, does not affect credit scores, and requires contacting Equifax, Experian and TransUnion separately.
A fraud alert works differently: it tells businesses to verify your identity before opening a new account. The FTC explains the differences between a credit freeze and a fraud alert.
When there is already misuse of personal information, IdentityTheft.gov allows you to report identity theft and obtain a recovery plan.
CenterPoint says the breach did not disrupt electric or gas service
CenterPoint assured that the provision of its electricity and gas services was not affected and continued operating during the incident.
The investigation remained open in the latest information reviewed. As of October 16, CenterPoint had not published a breakdown that would allow determining how many of the affected people live in Houston or Harris County.
Related: CenterPoint plans a $176.7 million project to reinforce Houston’s electric grid
