CenterPoint Energy confirms data breach following claims on hacking forum

CenterPoint Energy disclosed that an unauthorized third party accessed customer data via an external API allegedly lacking WAF, rate limiting, certificate checks, and authentication; a threat actor claiming the handle ‘4d722e4d656f77’ stated they pulled 7.49 million lines of customer data (potentially up to 17.44 million) containing names, contact and billing addresses, account and premise IDs, driver’s license numbers, emails, and partial SSNs. The company filed an SEC Form 8-K acknowledging an online post, is engaging external experts to determine scope, plans to notify affected customers and authorities, and faces class-action lawsuits in multiple states.