If you pay an electric or gas bill every month, you probably think about the amount due, not all the personal information sitting behind that account.
asserted
you → pay → account
But your utility company may have your home address, phone number, billing history and other details that can become very useful in the wrong hands.
uncertain
that → have → hands
That is what makes the breach at CenterPoint Energy worth paying attention to, even if you have never been one of its customers.
asserted
you → make → customers
CenterPoint says an unauthorized third party obtained personal information belonging to some customers through an external-facing system.
asserted
party → say → system
A hacker, meanwhile, claims to have stolen 7.49 million customer records, including addresses, account numbers, billing information and partial Social Security numbers.
uncertain
hacker → claim → addresses
CenterPoint has confirmed that customer information was stolen, but it has not confirmed the hacker's 7.49 million figure or the specific information the attacker says was taken.
asserted
attacker → confirm → figure
So, there are still plenty of questions about how big this breach really is.
asserted
breach → be → questions
Here's what CenterPoint has confirmed, what the hacker is claiming and what you should watch for now.
asserted
you → confirm → what
Free CyberGuy LIVE class: Get Better Healthcare With AI Saturday, September 26 at 11 a.m. ET / 8 a.m. PT
Kurt "CyberGuy" Knutsson will show you five practical ways AI can help you organize your health history, remember important appointment details, understand complicated medical information, research prescriptions and prepare smarter questions for your doctor.
asserted
you → get → doctor
No technical experience is needed.
asserted
experience → need → ?
CenterPoint Energy confirms customer data was stolen
CenterPoint Energy disclosed the incident in a Sept. 14 filing with the U.S. Securities and Exchange Commission.
asserted
Energy → confirm → Commission
The Houston-based utility says it became aware of an online post from a third party claiming to possess a data set containing CenterPoint customer information.
asserted
it → base → information
CenterPoint then activated its cybersecurity incident response procedures and brought in outside cybersecurity experts.
asserted
CenterPoint → activate → experts
As the investigation progressed, the company determined that an unauthorized third party had obtained personal information belonging to some customers through one of its external-facing systems.
asserted
party → progress → systems
CenterPoint has not publicly said how many customers were affected.
asserted
customers → say → ?
It also has not detailed which types of personal information were taken.
asserted
types → detail → information
The company says it plans to notify affected customers and regulators as required once it determines the scope of the incident.
asserted
it → say → incident
CyberGuy reached out to CenterPoint Energy asking whether it could confirm the hacker's claim that 7.49 million records were stolen, what customer information was affected and whether a public API was involved.
uncertain
API → reach → claim
CenterPoint referred us to its SEC filing and provided this statement: "Our filing speaks for itself."
asserted
filing → refer → itself
The company did not provide additional details in response to our questions.
asserted
company → provide → questions
There is one piece of reassuring news for anyone who depends on CenterPoint for power or gas.
asserted
who → be → power
The company says its electric and natural gas services continued operating normally during the incident.
asserted
services → say → incident
CenterPoint also says it currently does not expect the breach to have a material impact on its financial condition.
asserted
breach → say → condition
Hacker claims 7.49 million CenterPoint records were stolen
The bigger number comes from the attacker.
uncertain
number → claim → attacker
A threat actor using the alias "4d722e4d656f77" told BleepingComputer that they obtained 7.49 million CenterPoint customer records.
asserted
they → use → records
According to the hacker, those records contain:
- Names
- Phone numbers
- Service and billing addresses
- CenterPoint account numbers
- Billing amounts
- Partial Social Security numbers
The attacker later leaked the data after claiming CenterPoint ignored their attempts to make contact.
uncertain
CenterPoint → accord → contact
Again, CenterPoint has confirmed that customer information was stolen, but it has not independently confirmed this list of exposed data or the 7.49 million record count.
asserted
it → confirm → data
Also, 7.49 million records does not necessarily mean 7.49 million individual people were affected.
asserted
people → mean → ?
One person or household can potentially appear in more than one record.
asserted
person → appear → record
CenterPoint says it is still working to determine the actual scope.
asserted
it → say → scope
Hacker says a public CenterPoint system allowed automated data access
The attacker's explanation of how the theft allegedly happened may be one of the most interesting parts of this breach.
uncertain
theft → say → breach
The hacker told BleepingComputer they accessed the information by repeatedly cycling through millions of IDs using a public CenterPoint API.
asserted
they → tell → API
An API allows different software systems to exchange information.
asserted
systems → allow → information
Companies use them constantly behind websites and apps.
asserted
Companies → use → websites
According to the attacker, CenterPoint's API lacked protections that could have slowed or blocked mass automated requests.
uncertain
that → accord → requests
The hacker specifically claimed there was no effective rate limiting or web application firewall protection against the activity.
asserted
hacker → claim → activity
CenterPoint's SEC filing does not confirm that attack method.
asserted
filing → confirm → method
What CenterPoint does confirm is that the unauthorized third party obtained information through an external-facing system.
asserted
party → confirm → system
That means we should treat the API explanation as the attacker's account until the company or investigators provide more technical details.
asserted
company → mean → details
Why stolen utility records can be valuable to scammers
A utility account may not seem as sensitive as a bank account.
uncertain
account → steal → account
…and 58 more, not listed.
The Aporia
