Texas utility CenterPoint Energy has confirmed that an attacker breached one of its internet-facing systems and stole customer personal information. The company disclosed the incident in a Form 8-K filing with the US Securities and Exchange Commission, after someone posted on a cybercrime forum claiming to be selling the stolen data. CenterPoint, which serves around 7 million customers, said its electricity and gas services have not been disrupted and continue to operate normally.

The forum poster claims to have extracted 7.49 million files via a poorly secured API, allegedly including customer names, contact details, billing information, move-in dates, driver's licence details and the last four digits of Social Security numbers; The Register has not independently verified these claims, and CenterPoint declined to comment further beyond its filing. The company says it is working with third-party experts to establish the scope of the breach, has alerted law enforcement and some regulators, and plans to notify affected customers as required by law, while stating it does not expect the incident to have a material financial impact. The report notes wider concerns about cyberattacks on critical infrastructure, citing recent incidents affecting facilities in Poland and the UK and over 100 US water systems in July.