Breach taxonomy
Summary
In September 2026, CenterPoint Energy became aware of an online post by a third party claiming to hold a data set of company customer information. Its investigation confirmed that an unauthorized third party obtained personal information relating to a portion of its customers through one of the company's external-facing systems. Electric and gas delivery services were unaffected and remained operational. The company notified law enforcement and certain regulators, is determining the scope of affected customers, and expects its cyber insurance to offset related costs. Filed under Item 8.01; materiality not yet determined as of the filing date.
Tagging rationale
ThreatUnknown
Filing refers only to 'an unauthorized third party' and 'an online post by a third party' without identifying an actor category -> UNKNOWN.
MethodsData ExfilApp Exploit
Filing confirms customer personal information was obtained and later posted online, and specifies it was taken 'through one of the Company's external facing systems' -> DATA-EXFIL plus APP-EXPLOIT.
AssetsPersonal Data
Filing states the unauthorized third party 'obtained personal information relating to a portion of the Company's customers' -> PERSONAL-DATA.
EffectsInfo Privacy Loss
Filing states customer personal information was obtained while 'delivery of electric and gas services has not been impacted' -> INFO-PRIVACY-LOSS only.
Business continuityNot Required
Filing states electric and gas service 'remains operational and undisrupted', so continuity procedures were not required -> Not Required.
Impact
Customer personal information for a portion of the utility's customer base was exfiltrated with no service disruption, and the company expects insurance to offset the costs -> score 2.
InsuranceYes
Filing states 'The Company maintains customary cybersecurity insurance coverage and believes this insurance will offset related costs' -> true.
Read the original SEC filing excerpt
Item 8.01 Other Events. In September 2026, CenterPoint Energy, Inc. (the "Company") became aware of an online post by a third party claiming to have obtained a data set containing certain of the Company's customer information. Upon becoming aware of the post, the Company promptly took action and activated its cybersecurity incident response protocols, initiated an investigation with the assistance of third-party cybersecurity experts, and took steps to further protect the Company's systems. The Company's delivery of electric and gas services has not been impacted and remains operational and undisrupted. As of the date of this filing, the Company does not believe it is reasonably likely that there will be a material impact on the Company's financial condition or results of operations. While the investigation remains ongoing, the Company has determined that an unauthorized third party obtained personal information relating to a portion of the Company's customers through one of the Company's external facing systems (the "Incident"). The Company is continuing to work with third-party experts to determine the scope of customers and personal information affected by the Incident and intends to notify affected customers and regulatory authorities as required by applicable law. The Company reported the matter to law enforcement authorities and has notified certain regulatory authorities of the issue. The Company has incurred, and expects to continue to incur, certain expenses related to the Incident and its response to the Incident. The Company maintains customary cybersecurity insurance coverage and believes this insurance will offset related costs.