More than one million Texans were affected by a CenterPoint Energy data breach that compromised sensitive personal information, according to newly published information from the Texas Attorney General’s Office.
The state’s data breach database lists 1,062,060 Texans as being affected. The information involved includes customers’ names, addresses, Social Security information and driver’s-license numbers.
The report, published on the attorney general’s website Monday, indicates that affected consumers had not yet been notified at the time the information was submitted. The state notes that the number of affected Texans and the status of consumer notifications may later be updated.
CenterPoint first publicly disclosed the incident in a Sept. 14 filing with the U.S. Securities and Exchange Commission. At the time, the company did not reveal how many customers were affected or what types of personal information were compromised.
In that filing, CenterPoint said it became aware of an online post by a third party claiming to have obtained a dataset containing customer information. The company activated its cybersecurity response protocols and hired outside experts to investigate.
On Wednesday, a spokesperson for CenterPoint said:
“CenterPoint Energy continues to actively investigate the cybersecurity incident disclosed last month. Upon learning of the issue, CenterPoint activated our incident response procedures and engaged external cybersecurity, forensic, and legal advisors to assist with the investigation.
“We continue to work with third-party experts to assess the scope of affected customer data to identify which customers will be provided notifications in accordance with applicable legal requirements.
“CenterPoint’s delivery of electric and gas services has not been impacted and remains operational and undisrupted.”
Texas law requires businesses and organizations to report breaches affecting at least 250 Texans to the attorney general as soon as practicable and no later than 30 days after discovering the breach. Affected consumers generally must be notified without unreasonable delay and no later than 60 days after the company determines a breach occurred.
