CenterPoint Energy Confirms Customer Data Stolen in Cyberattack
CenterPoint Energy has confirmed that an unauthorized third party obtained personal information belonging to some of its customers after attackers allegedly leaked data stolen from the utility.
The company launched an investigation after discovering an online post from an attacker who claimed to have stolen 7.49 million records.
CenterPoint Energy data breach exposed customer information
CenterPoint Energy is a Houston-based utility company that provides electric and natural gas services and operates power generation facilities.
The company serves approximately 7 million customers in Indiana, Minnesota, Ohio, and Texas. CenterPoint Energy has approximately 8,300 employees and annual revenues of more than $9.3 billion.
Earlier this month, an attacker using the alias “4d722e4d656f77” told BleepingComputer that they stole 7.49 million customer records from CenterPoint Energy. The allegedly stolen data included names, phone numbers, service and billing addresses, account numbers, billing amounts, and some Social Security numbers (SSNs).
The threat actor claimed the data was leaked after CenterPoint Energy allegedly ignored their messages and treated them as jokes.
According to the intruders, they exfiltrated the data by iterating through millions of identities on CenterPoint Energy’s public API. They claimed the API lacked rate limiting, web application firewall (WAF) protection, and other security measures designed to prevent automated access.
CenterPoint acknowledges unauthorized access in SEC filing
CenterPoint Energy acknowledged in a filing with the U.S. Securities and Exchange Commission (SEC) that data was stolen. However, the company did not identify the threat actor or disclose how many customers were affected or what specific types of data were compromised.
“While the investigation is ongoing, we have determined that an unauthorized third party obtained personal information about some of our customers through one of our external systems.” Read the SEC filing.
“We continue to work with third-party experts to determine the scope of customer and personal information affected by the incident and will notify affected customers and regulators as required by applicable law.”
Utility services were not affected
CenterPoint Energy said its electricity and natural gas services were not affected by the cyberattack. The company also said it does not believe the incident will have a material impact on its business or financial condition.
CenterPoint initiated incident response procedures, hired third-party cybersecurity experts, enhanced protection of its systems, and reported the incident to law enforcement and regulatory authorities.
Lawsuit filed over alleged CenterPoint data breach
A lawsuit has already been filed against the company in federal court by a law firm representing potentially affected customers. The complaint alleges that the data breach occurred between August 17 and September 1. Read more about the proposed class action lawsuit.
Join Mikko Hypponen and security leaders from the NFL, Chanel, and Atlassian for a 2-hour digital summit about what will change with AI speed attacks, what defenders should stop doing, and how to verify, decide, fix, and revalidate at machine speed.
Source: www.bleepingcomputer.com