CenterPoint Energy, the primary electricity and natural gas provider for League City, confirmed that an unauthorized third party accessed personal information from an undisclosed number of customers.
The Houston-based utility disclosed the breach in a Form 8-K filing with the SEC on Monday, Sept. 14, KHOU reported. CenterPoint said it learned of an online post in September 2026 claiming a third party had obtained a dataset of customer information. The company activated its cybersecurity response protocols and brought in outside experts.
CenterPoint has not said how many customers were affected or what types of personal data were taken. A spokesperson told KPRC 2, "Our filing speaks for itself."
The company has not confirmed whether League City customers are among those affected.
Five lawsuits allege millions of records exposed
Five proposed class-action lawsuits have been filed against CenterPoint in the Southern District of Texas, according to TEISS. Three were filed by Florida law firm Shamis and Gentile. Two were filed by Dallas firm Lippe and Associates. Plaintiffs include Latoya Wyche, a Texas resident, and Nathaniel Sonia, a Minnesota customer.
The lawsuits allege the breach occurred between Aug. 17 and Sept. 1. They claim cybercriminals accessed customer names, phone numbers, addresses, billing information and Social Security numbers. One lawsuit estimates roughly 7 million records were leaked; another puts the figure at about 6.7 million. CenterPoint has not confirmed any of those figures.
Three of the suits point to CenterPoint's online guest bill pay feature as the alleged weak point. That feature lets customers pay a bill using only an account number but also retrieves personal information when the correct number is entered, the Houston Chronicle reported. CenterPoint told the Chronicle it does not comment on pending litigation.
What the threat actor claims
A threat actor using the alias "4d722e4d656f77" told BleepingComputer they took 7.49 million customer records. The actor claimed the data includes names, phone numbers, service and billing addresses, account numbers, billing amounts and partial Social Security numbers. CenterPoint has not confirmed any of those specifics.
The actor alleged they pulled the data by cycling through millions of IDs on a CenterPoint public API that lacked basic security protections. CenterPoint has not confirmed that method.
Notification timeline under Texas law
CenterPoint serves about 7 million metered customers across Texas, Indiana, Minnesota and Ohio. The company said electric and natural gas service has not been disrupted.
CenterPoint said it plans to notify affected customers as required by law. Under the Texas Identity Theft Enforcement and Protection Act, businesses must report a breach affecting 250 or more Texans to the Texas Attorney General's Office within 30 days of discovery and notify affected consumers.
Residents who receive a breach notice from CenterPoint can file a consumer complaint with the Texas Attorney General's Office at texasattorneygeneral.gov.
