--- title: "CenterPoint Energy confirms hackers stole custo… | Firevault" url: https://fire-vault.com/news/centerpoint-energy-confirms-cyberattack-data-theft-2026 description: "CenterPoint Energy has confirmed that criminals stole customer data through one of its external facing systems, after a threat actor advertised 7.49 million…" lang: en-GB --- News · Breach Analysis · 16 September 2026 # CenterPoint Energy confirms hackers stole customer data through an exposed API CenterPoint Energy has confirmed that criminals stole customer data through one of its external facing systems, after a threat actor advertised 7.49 million files on a dark web forum. Mark Fermor on what an unsecured API says about the way critical infrastructure treats connected data. Image: Mark Fermor (https://fire-vault.com/assets/mark-fermor-DWFWqeWL.jpg) Mark Fermor CTO, CMO & Founder, Firevault 4 min read Share Share on LinkedIn: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fcenterpoint-energy-confirms-cyberattack-data-theft-2026 Share on X: https://twitter.com/intent/tweet?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fcenterpoint-energy-confirms-cyberattack-data-theft-2026&text=CenterPoint%20Energy%20confirms%20hackers%20stole%20customer%20data%20through%20an%20exposed%20API%0A%0ACenterPoint%20Energy%20has%20confirmed%20that%20criminals%20stole%20customer%20data%20through%20one%20of%20its%20external%20facing%20systems%2C%20after%20a%20threat%20actor%20advertised%207.49%20million%20files%20on%20a%20dark%20web%20forum.%20Mark%20Fermor%20on%20what%20an%20unsecured%20API%20says%20about%20the%20way%20critical%20infrastructure%20treats%20connected%20data. Share on Facebook: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffire-vault.com%2Fnews%2Fcenterpoint-energy-confirms-cyberattack-data-theft-2026 Image: Electricity transmission pylons at dusk overlaid with a cyan network grid, one pylon glowing magenta to signal a compromised system (https://fire-vault.com/news/centerpoint-energy-cyberattack-2026.jpg) Electricity transmission pylons at dusk overlaid with a cyan network grid, one pylon glowing magenta to signal a compromised system Why it matters ## What this means for organisations holding critical data ## What happened CenterPoint Energy, one of the largest utility companies in the United States, has confirmed that an unauthorised third party obtained personal information belonging to some of its customers through one of the company's external facing systems. The confirmation came in a filing with the US Securities and Exchange Commission on 14 September, days after a threat actor posted on a dark web forum claiming to have stolen 7.49 million CenterPoint files through a poorly secured API. According to The Register, the advertised data includes customer names and contact details, billing information, move in dates, driving licence information and the last four digits of Social Security numbers. CenterPoint delivers electricity and natural gas to homes and businesses, employs roughly 8,800 people and operates around 48.3 billion dollars in assets. The company says its operations were not affected and continue as normal. It has activated its incident response protocols, brought in third party cyber security experts, notified law enforcement and regulators, and says it will inform affected customers as required by law. It has also warned investors that the incident has already incurred expenses, with more expected as the investigation continues. The scale claimed by the criminals, 7.49 million files, has not been independently verified. But the company has confirmed the essential point: customer data left the building. ## The front door nobody was watching If the claim of a poorly secured API proves accurate, this will not be a story about an elite hacking crew defeating state of the art defences. It will be a story about a door that was left unlocked. APIs are the connective tissue of modern business. They let systems talk to each other, and they are everywhere. They are also routinely treated as plumbing rather than as what they actually are: direct routes into your most sensitive data, reachable by anyone on the internet who cares to look. I have lost count of the organisations that can tell me in detail how their perimeter is defended, but cannot tell me how many external facing interfaces they have, what data each one can reach, or when anyone last checked. The perimeter gets the budget and the attention. The quiet connections get neither. ## Critical infrastructure is not just the grid When we talk about protecting critical infrastructure (https://fire-vault.com/control-for-critical-infrastructure), the conversation usually jumps straight to operational technology: the control systems, the substations, the physical network. CenterPoint says its operations were unaffected, and that matters. Nobody's lights went out. But a utility is more than its grid. It is also decades of customer records: names, addresses, billing histories, identity documents (https://fire-vault.com/oss-for-identity-documents). For a criminal, that dataset is a gift. It enables identity fraud, highly convincing phishing and targeted social engineering against millions of households, and it never expires. You cannot change your move in history or your billing record the way you change a password. If your organisation holds data that would harm your customers for years if it were published, the question is not whether it sits behind a firewall. The question is whether it needs to be connected at all. ## The question worth asking Every external facing system in your estate should be able to answer three questions. What data can it reach? Who is watching it? And does the data behind it need to be there? Where records must be retained for regulatory or operational reasons, Offline Secure Storage (https://fire-vault.com/offline-secure-storage)® keeps them on dedicated hardware that is physically disconnected when not in use. An exposed API cannot leak an archive it cannot reach, and a criminal forum cannot advertise what was never connected in the first place. Audit every connection as if it were a door, because that is exactly what it is. And put your crown jewels somewhere the doors do not go. _Mark Fermor is the founder of Firevault._ ## Sources - TechRadar Pro: CenterPoint Energy confirms hackers compromised networks and stole data: https://www.techradar.com/pro/security/centerpoint-energy-confirms-hackers-compromised-networks-and-stole-data-and-the-hackers-claim-theft-of-7-5-million-files - CenterPoint Energy 8-K filing with the US Securities and Exchange Commission, 14 September 2026: https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001130310&type=8-K About the author ### Mark Fermor Mark Fermor on LinkedIn (https://www.linkedin.com/in/mfermor) CTO, CMO & Founder Founder of Firevault, focused on offline secure storage and protecting individuals and businesses from fraud, fines, loss and damage. Speaker, owner and advisor. How Firevault would handle this ## Controls an auditor can physically verify Firevault gives you physical separation, named custody and evidenced access, so compliance claims about isolation and control are things you can show, not just assert. Get started: https://fire-vault.com/get-started Talk to the team: https://fire-vault.com/demo **Custody**Named, access-controlled hardware in a Firevault Bunker **Evidence**Access windows and retrieval events are recorded **Separation**Physical isolation that satisfies offline copy requirements **Jurisdiction**Stored where your regulatory position requires Related Reading ## You may also find these useful Breach Analysis ### ASOS data breach: stolen customer profiles and a hijacked app notification ASOS confirms customer-data exposure after attackers hijacked its app notifications. What happened, what was taken and why a stolen login can put more than contact details at risk. 12 Oct 2026 14 min https://fire-vault.com/news/asos-data-breach-customer-profiles-october-2026 Breach Analysis ### Dyfed-Powys Police confirms cyber attack as staff information may have been compromised Dyfed-Powys Police has confirmed that a cyber attack identified on 14 September disrupted non-emergency systems and may have exposed staff information. The force says it has found no evidence that public data was accessed. 25 Sept 2026 3 min https://fire-vault.com/news/dyfed-powys-police-cyber-attack-2026 Breach Analysis ### FBI investigates claims that hackers stole personnel and applicant data The FBI is investigating unauthorised activity affecting its recruitment website after ShinyHunters claimed it stole sensitive records on current and former personnel and job applicants. The claimed scale remains unconfirmed. 22 Sept 2026 4 min https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026 Breach Analysis ### Vulnerable children's health records caught up in HCRG Care Group cyber attack, families told 18 months later Families of vulnerable children in Wiltshire, Bath and North East Somerset have been told their personal health information may have been accessed in a cyber attack on HCRG Care Group in February 2025, more than 18 months after the incident. 20 Sept 2026 4 min https://fire-vault.com/news/hcrg-care-group-children-records-cyber-attack-2026 Breach Analysis ### FBI and Coast Guard board oil tankers after suspected foreign cyberattacks on ships entering US waters US authorities boarded two foreign-flagged oil tankers in the Gulf of Mexico after indications their networks were compromised by foreign cyber actors. Mark Fermor on why a ship is a floating lesson in what happens when operational technology is reachable. 17 Sept 2026 4 min https://fire-vault.com/news/fbi-coast-guard-probe-cyberattacks-oil-tankers-us-waters-2026 Breach Analysis ### FBI investigates 153 million drivers licenses put up for sale on a criminal forum A dark web service claimed to be selling scans of more than 153 million drivers licenses, apparently taken from a Louisiana identity verification company used by household names. The FBI has opened an inquiry, and the case shows how long retention turns a routine check into national-scale exposure. 16 Sept 2026 4 min https://fire-vault.com/news/fbi-investigates-153-million-drivers-licenses-dark-web-2026 ## Suggested Reading - What is Offline Secure Storage The foundation of physical disconnection: https://fire-vault.com/how-it-works/offline-secure-storage - Why Offline Secure Storage The case for physical control: https://fire-vault.com/why-oss - Ransomware Defence Hold gold copies offline: https://fire-vault.com/oss-for-ransomware-recovery - Control Physical path control for IT and OT: https://fire-vault.com/solutions/control - Knowledge Vault All articles, guides and whitepapers: https://fire-vault.com/learn/knowledge - Book a Demo See Firevault in action: https://fire-vault.com/demo Back to Knowledge Vault: https://fire-vault.com/learn/knowledge ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/centerpoint-energy-confirms-cyberattack-data-theft-2026#webpage", "url": "https://fire-vault.com/news/centerpoint-energy-confirms-cyberattack-data-theft-2026", "name": "CenterPoint Energy confirms hackers stole custo…", "description": "CenterPoint Energy has confirmed that criminals stole customer data through one of its external facing systems, after a threat actor advertised 7.49 million…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/news/centerpoint-energy-cyberattack-2026.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/centerpoint-energy-confirms-cyberattack-data-theft-2026#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/centerpoint-energy-confirms-cyberattack-data-theft-2026#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "CenterPoint Energy confirms hackers stole customer data through an exposed API", "item": "https://fire-vault.com/news/centerpoint-energy-confirms-cyberattack-data-theft-2026" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "CenterPoint Energy confirms hackers stole customer data through an exposed API", "description": "CenterPoint Energy has confirmed that criminals stole customer data through one of its external facing systems, after a threat actor advertised 7.49 million files on a dark web forum. Mark Fermor on what an unsecured API says about the way critical infrastructure treats connected data.", "url": "https://fire-vault.com/news/centerpoint-energy-confirms-cyberattack-data-theft-2026", "image": [ { "@type": "ImageObject", "url": "https://fire-vault.com/news/centerpoint-energy-cyberattack-2026.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://fire-vault.com/news/centerpoint-energy-cyberattack-2026.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://fire-vault.com/news/centerpoint-energy-cyberattack-2026.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://fire-vault.com/news/centerpoint-energy-cyberattack-2026.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "CTO, CMO & Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2026-09-16T16:10:00+00:00", "dateModified": "2026-09-18T05:32:02.285666+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/centerpoint-energy-confirms-cyberattack-data-theft-2026" }, "inLanguage": "en-GB", "articleSection": "Breach Analysis", "wordCount": 665, "keywords": "CenterPoint, Breach Analysis, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "## What happened CenterPoint Energy, one of the largest utility companies in the United States, has confirmed that an unauthorised third party obtained personal information belonging to some of its customers through one of the company's external facing systems. The confirmation came in a filing with the US Securities and Exchange Commission on 14 September, days after a threat actor posted on a da", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What happened at CenterPoint Energy?", "acceptedAnswer": { "@type": "Answer", "text": "CenterPoint Energy confirmed in an SEC filing that an unauthorised third party obtained personal information relating to a portion of its customers through one of the company's external facing systems. A threat actor had earlier advertised 7.49 million allegedly stolen files on a dark web forum." } }, { "@type": "Question", "name": "What customer data was taken?", "acceptedAnswer": { "@type": "Answer", "text": "According to the forum post reported by The Register, the data includes customer names and contact details, billing data, move in dates, driving licence information and the last four digits of Social Security numbers. The claimed volume has not been independently verified." } }, { "@type": "Question", "name": "How did the attackers get in?", "acceptedAnswer": { "@type": "Answer", "text": "The threat actor claims the data was taken through a poorly secured API, an application programming interface exposed to the internet. CenterPoint has confirmed only that an external facing system was involved and that its investigation is ongoing." } }, { "@type": "Question", "name": "Were energy supplies disrupted?", "acceptedAnswer": { "@type": "Answer", "text": "No. CenterPoint says the attack did not affect its operations, which continue as normal. The impact is confined to customer data, incident response costs and regulatory obligations." } }, { "@type": "Question", "name": "Why is utility customer data valuable to criminals?", "acceptedAnswer": { "@type": "Answer", "text": "Utility records combine identity details, addresses and billing histories that enable identity fraud and highly convincing phishing. Unlike a password, this information cannot be changed once it is exposed, so it retains criminal value for years." } }, { "@type": "Question", "name": "How can organisations reduce the risk from exposed APIs?", "acceptedAnswer": { "@type": "Answer", "text": "Inventory every external facing interface, restrict what data each can reach and monitor them continuously. Records that must be retained but are rarely needed should be held in offline storage on dedicated hardware, physically disconnected when not in use, so no internet facing system can reach them." } } ] } ] ```