TEXAS — A data breach at CenterPoint Energy, the utility that delivers electricity to homes and businesses in parts of Wharton County, affected more than 1 million Texans and involved personal information including Social Security information and driver’s license numbers.
The number reported to the Texas Attorney General’s Office is 1,062,060 Texas residents. Names and addresses were also among the information involved. A breakdown showing how many affected customers live in Wharton County has not been confirmed.
For local residents, the unanswered question is whether their own information was taken. CenterPoint’s disclosures describe the breach as affecting some customers, so receiving electricity through the company does not automatically mean a household’s information was exposed.
The company’s electric service-area documents list several Wharton County communities, including Boling, East Bernard, Egypt and Glen Flora.
How CenterPoint learned about the breach
CenterPoint publicly disclosed the incident in a September 14 filing with the Securities and Exchange Commission.
The company said it learned that month of an online post from someone claiming to have obtained customer information. CenterPoint brought in outside cybersecurity experts, began investigating and took steps to protect its systems.
Investigators determined that an unauthorized third party had obtained customer personal information through one of the company’s systems accessible from outside its network. CenterPoint also said it reported the matter to law enforcement and notified certain regulators.
That initial disclosure did not say how many customers were affected or identify the types of personal information involved. Those details emerged later through the state breach report.
Customer notifications still being assessed
The state report indicated that affected customers had not yet been notified when the information was submitted. That does not establish whether notices have been sent since then. The Attorney General’s public breach database warns that affected-person counts and notification details can change.
In an October 14 statement, CenterPoint said it was still working with outside cybersecurity, forensic and legal advisers to investigate. The company said it was reviewing the affected data to identify which customers would receive notices under applicable legal requirements.
CenterPoint said electricity and natural gas delivery remained operational and uninterrupted. The incident involves customer information; the company has not reported a resulting disruption to those services.
What customers can do
Residents whose Social Security information may have been exposed can check their credit reports for accounts they do not recognize. The Federal Trade Commission also recommends considering a credit freeze or fraud alert after this type of breach. Its data breach guidance explains which steps to take based on the information involved.
Freezing and unfreezing credit is free. A freeze makes it harder for someone to open a new credit account in another person’s name. Consumers must request a freeze separately with Equifax, Experian and TransUnion.
Anyone who discovers that their information has been used fraudulently can report it through IdentityTheft.gov, which provides a recovery plan.
Leave a Reply