A data breach at CenterPoint Energy exposed the personal information of more than 1 million Texas customers, including League City residents served by the Houston-based utility.

Texas Attorney General Ken Paxton's office published the breach report on Tuesday, Oct. 13, listing 1,062,060 affected Texans, KPRC 2 first reported. The compromised data includes customers' names, addresses, Social Security information and driver's license numbers.

CenterPoint's electric delivery territory covers League City and the broader Houston metro area, serving nearly 2.8 million metered customers, according to CenterPoint.

As of the AG report filing, CenterPoint had not notified any of the affected customers.

Timeline of the breach

CenterPoint first disclosed the incident in a Sept. 14 filing with the U.S. Securities and Exchange Commission (SEC). The company said it became aware of an online post by a third party claiming to have obtained a dataset of customer information. CenterPoint said it activated its cybersecurity response protocols and hired outside experts to investigate.

The SEC filing did not say how many people were affected or what types of data were compromised. SecurityWeek reported that a hacker posted claims on a cybercrime forum on Sept. 12, two days before CenterPoint's disclosure, alleging they had obtained millions of customer records.

CenterPoint has not confirmed whether the AG report references the same incident disclosed in the SEC filing. The Houston Chronicle reported that the company's statement did not address whether the two were connected.

A CenterPoint spokesperson told KPRC 2 on Wednesday, Oct. 14, that the company "continues to actively investigate the cybersecurity incident disclosed last month." The spokesperson said CenterPoint is working with third-party experts to determine which customers will receive notifications.

The company said its electricity and gas delivery services were not disrupted.

Lawsuits and allegations

Five customers across multiple states have filed proposed class-action lawsuits against CenterPoint in the Southern District of Texas, the Houston Chronicle reported. The lawsuits allege the breach occurred between Aug. 17 and Sept. 1.

Three of the lawsuits, filed by Florida law firm Shamis and Gentile, singled out CenterPoint's online guest bill pay feature as the alleged vulnerability. That feature allows customers to pay using an account number but also retrieves personal information when the correct number is entered, the lawsuits state.

None of the proposed classes have been certified. CenterPoint has not responded to the allegations in the lawsuits.

What League City customers should do

Texas law requires companies to notify affected consumers no later than 60 days after determining a breach occurred. CenterPoint has not said when notifications will go out.

The Federal Trade Commission (FTC) recommends placing a free credit freeze with all three credit bureaus: Equifax, Experian and TransUnion. A credit freeze prevents anyone from opening new credit accounts in your name and does not affect your credit score, according to the FTC.

Residents can also place an initial fraud alert, which requires businesses to verify identity before opening new accounts. The FTC recommends checking credit reports regularly for unfamiliar accounts at AnnualCreditReport.com.