Summary
- Environment: An external-facing company system
- Operational impact: Electric and gas delivery reported undisrupted at disclosure
- Financial impact: No incident cost established in the reviewed evidence
- Record status: Developing record. Reviewed October 14, 2026; updated as evidence emerges.
What happened
CenterPoint Energy confirmed that an unauthorized party obtained some customers’ personal information through an external-facing system. Its September 14 filing followed investigation of an online claim discovered that month. [1]
Impact
Electric and gas delivery remained operational. At disclosure, the company was still assessing the affected customers and data categories. It did not consider a material financial or operating-results impact reasonably likely, but had incurred unquantified response expenses. [1]
Timeline
Data acquisition disclosed
The company filed its incident disclosure while the scope investigation continued.
[1]Briefing updated
This briefing was last reviewed and updated on October 14, 2026.
Threat Group & Attack Vector
The filing identifies an external-facing system but gives no precise intrusion date, initial access method or attacker attribution. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
CenterPoint activated incident response, retained external experts, strengthened protections and notified law enforcement and certain regulators. [1]