CenterPoint Energy, a Houston-based utility holding company, disclosed a customer data breach in a Sept. 14 filing with the U.S. Securities and Exchange Commission.
According to the filing, the company became aware this month of an online post from a third party claiming to have obtained a dataset containing customer information. “Upon becoming aware of the post, the Company promptly took action and activated its cybersecurity incident response protocols,” the filing states.
CenterPoint launched an investigation with outside cybersecurity experts and took steps to further protect its systems. The investigation determined that an unauthorized third party obtained personal information involving a portion of its customers through one of its external-facing systems.
However, the company has not disclosed several key details. It has not specified what types of personal information were involved, how many customers may be affected, or when the data was accessed. The company also stated it is “working with third-party experts to determine which customers and information were affected.”
CenterPoint said its “delivery of electric and gas services has not been impacted and remains operational and undisrupted.” The company intends to notify affected customers and regulatory authorities as required by law and has reported the matter to law enforcement.
Regarding financial impact, CenterPoint stated that “as of the date of this filing, the Company does not believe it is reasonably likely that there will be a material impact on the Company’s financial condition or results of operations.” The company expects to incur expenses related to the incident and its response. “The Company maintains customary cybersecurity insurance coverage and believes this insurance will offset related costs,” according to the filing.
As of the time of reporting, CenterPoint had not issued news releases or commented through social media channels about the breach. When contacted by media, a company spokesperson stated, “Our filing speaks for itself.”
CenterPoint Energy operates electric transmission and distribution systems and natural gas distribution systems through its subsidiaries. In Southeast Texas, the company provides natural gas service to areas including Beaumont, Port Arthur, Nederland, Orange, Bridge City, Vidor, Silsbee, Lumberton, Jasper, and Kirbyville.
Key facts
- CenterPoint Energy discovered unauthorized access to customer personal information through an external-facing system
- The company became aware of the breach this month after spotting an online post claiming access to the dataset
- CenterPoint has not disclosed how many customers were affected or what specific information was compromised
- The utility’s electric and gas service delivery remains operational and unaffected
- The company has reported the matter to law enforcement and notends to notify affected customers as required by law
- CenterPoint maintains cybersecurity insurance expected to offset response costs