---
title: "CenterPoint Energy customer-data incident"
description: "CenterPoint Energy confirmed customer personal-information acquisition through an external-facing system in a September 2026 SEC filing."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-10-14"
canonical_url: "https://www.ally.security/incidents/centerpoint-energy-customer-data-incident-2026"
markdown_url: "https://www.ally.security/incidents/centerpoint-energy-customer-data-incident-2026.md"
stix_url: "https://www.ally.security/incidents/centerpoint-energy-customer-data-incident-2026/stix.json"
---

# CenterPoint Energy customer-data incident

The company confirmed unauthorized data acquisition while reporting uninterrupted electric and gas delivery.

Last modified Oct 14, 2026 · 1 source

## Summary

- **Environment:** An external-facing company system
- **Operational impact:** Electric and gas delivery reported undisrupted at disclosure
- **Financial impact:** No incident cost established in the reviewed evidence

## What happened

[CenterPoint Energy](https://www.centerpointenergy.com/) confirmed that an unauthorized party obtained some customers’ personal information through an external-facing system. Its [September 14 filing](https://www.sec.gov/Archives/edgar/data/1130310/000110465926107560/tm2625326d1_8k.htm) followed investigation of an online claim discovered that month. [1](#source-1)

## Impact

Electric and gas delivery remained operational. At disclosure, the company was still assessing the affected customers and data categories. It did not consider a material financial or operating-results impact reasonably likely, but had incurred unquantified response expenses. [1](#source-1)

## Timeline

### September 14, 2026 — Data acquisition disclosed

The company filed its incident disclosure while the scope investigation continued. [1](#source-1)

### October 14, 2026 — Briefing updated

This briefing was last reviewed and updated on October 14, 2026.

## Threat Group & Attack Vector

The filing identifies an external-facing system but gives no precise intrusion date, initial access method or attacker attribution. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

CenterPoint activated incident response, retained external experts, strengthened protections and notified law enforcement and certain regulators. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/centerpoint-energy-customer-data-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### CenterPoint Energy Form 8-K — customer-data incident

regulatory · CenterPoint Energy, Inc. · Sep 14, 2026

<https://www.sec.gov/Archives/edgar/data/1130310/000110465926107560/tm2625326d1_8k.htm>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Disclosed At · 100% confidence · current**  
   CenterPoint Energy customer-data breach: 2026-09-14
2. **Occurred At · 100% confidence · current**  
   Customer-data acquisition disclosed: 2026-09-14
3. **Resulted In · 100% confidence · current**  
   CenterPoint Energy customer-data breach: Electric and gas delivery remained operational and undisrupted, according to the September 14 filing.
4. **Resulted In · 100% confidence · current**  
   CenterPoint Energy customer-data breach: CenterPoint confirmed that an unauthorized third party obtained personal information about some customers through an external-facing system.
5. **Resulted In · 100% confidence · current**  
   CenterPoint Energy customer-data breach: At filing, CenterPoint did not consider a material effect on financial condition or operating results reasonably likely; it had incurred response expenses but disclosed no amount.
6. **Affected Organization · 100% confidence · current**  
   CenterPoint Energy customer-data breach: CenterPoint Energy, Inc.
7. **Resulted In · 100% confidence · current**  
   CenterPoint Energy customer-data breach: The company learned of an online claim in September and investigated; it did not establish an exact intrusion date in the filing.
8. **Resulted In · 100% confidence · current**  
   Customer-data acquisition disclosed: CenterPoint filed its disclosure while determining affected customers and data categories.
9. **Resulted In · 100% confidence · current**  
   CenterPoint Energy customer-data breach: Customer-data acquisition disclosed
10. **Resulted In · 100% confidence · current**  
   CenterPoint Energy customer-data breach: CenterPoint activated incident response, engaged external experts, strengthened protection and notified law enforcement and certain regulators.

</details>