CenterPoint Energy Data Breach, 1,062,060 Texans Affected, Class Action Lawsuits and What Customers Should Do

A breach report listed by the Texas Attorney General on October 13, 2026 shows 1,062,060 Texas residents were affected by the CenterPoint Energy data breach. The listed information includes names, addresses, Social Security number information and driver’s license numbers. CenterPoint confirmed in a September 14, 2026 SEC filing that an unauthorized third party obtained customer personal information through an external-facing system. Several customers have filed putative class action lawsuits in federal court in Houston.

There is no settlement, claim form or deadline. No court has certified a class, so you cannot claim money now. Do not trust any website that offers a payout. What you can do now is watch for an official notice, freeze your credit and monitor your accounts. Official breach listing: https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage

Independent publisher notice: AllAboutLawyer.com is an independent legal information website. We are not a law firm, we do not represent CenterPoint Energy or any plaintiff, and we do not process claims or compensation. Allegations in lawsuits are not findings of liability.

Quick Facts: CenterPoint Energy Data Breach

Item	Details
Official breach listing	Texas Attorney General data breach reports: https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage
Claim form / settlement	None. No settlement or class certification verified
Company	CenterPoint Energy, Inc. (NYSE: CNP)
Texas residents affected	1,062,060 (Texas AG listing, October 13, 2026)
Information listed	Names, addresses, Social Security number information, driver’s license numbers
Incident dates in AG record	August 19–22, 2026
Company disclosure	SEC Form 8-K filed September 14, 2026
Service impact	CenterPoint said electric and gas service were not disrupted
Court	U.S. District Court, Southern District of Texas
Lawsuits	At least seven federal suits filed September 9–23, 2026 (see table)
Class certification	None verified
Consolidation	Not verified as of this update
Admission of liability	None

What Happened

CenterPoint said it became aware in September of an online post claiming to offer customer data. It activated incident response procedures, brought in outside cybersecurity experts, reported the matter to law enforcement and notified certain regulators. Its September 14 SEC filing confirmed that an unauthorized third party obtained personal information relating to a portion of its customers through an external-facing system, said its investigation was continuing, and said it did not believe the incident was reasonably likely to have a material financial impact. It also said it carries cybersecurity insurance it believes will offset related costs.

The Numbers: Why Different Figures Appear

• 1,062,060 is the number of Texas residents in the Attorney General’s record, which is the count officially confirmed in a public regulator register.
• The person behind the online post claimed about 7.49 million records, and security press reports repeat that claim. CenterPoint has not confirmed that figure or the authenticity of the posted data.
• A larger combined figure (about 1.6 million) has appeared in some transcriptions. It is not independently confirmed here.
• CenterPoint serves customers in Texas, Indiana, Minnesota and Ohio, so residents of other states may be affected and covered by their own state’s laws and filings.

A claimed record count is not the same as the number of affected people, because datasets can contain duplicates and unverified entries.

What Information Was Exposed?

The Texas AG record lists names, addresses, Social Security number information and driver’s license numbers. It does not say that every person had every item exposed. The online poster claimed additional fields, including contact details, account identifiers, billing and payment information and the last four digits of Social Security numbers. Those claims are not confirmed by the company. Customers should not assume passwords, full card numbers or bank logins were taken unless an official notice says so.

Earlier incident: CenterPoint was separately named in connection with a 2023 breach tied to a third-party file-transfer product. That is a different incident and should not be mixed with this one.

The Lawsuits

Several customers filed separate proposed class actions in the Southern District of Texas, alleging CenterPoint failed to protect their data.

Plaintiff	Case number	Filed
Christa Floyd	4:26-cv-07567	September 9, 2026
Latoya Wyche	4:26-cv-07595	September 10, 2026
Joyce Curry	4:26-cv-07604	September 10, 2026
Nathaniel Sonia	4:26-cv-07608	September 10, 2026
Laurie Eirwin	4:26-cv-07626	September 11, 2026
Vivian Lindley	4:26-cv-07855	September 17, 2026
Austin Vickers	4:26-cv-08191	September 23, 2026

These are putative class actions. The complaints generally allege inadequate security safeguards and risk of identity theft. We have not independently reviewed each complaint’s counts or class definition, so check the dockets before relying on specific claims.

What Typically Happens Next

1. Consolidation and lead counsel. Courts often consolidate similar cases and appoint interim class counsel (Fed. R. Civ. P. 42(a) and 23(g)).
2. Motions to dismiss. CenterPoint can challenge standing and the legal sufficiency of the claims.
3. Discovery into security practices, if claims survive.
4. Class certification or settlement. The parties may negotiate a class settlement, which requires court approval. Many data breach cases settle, but there is no guarantee here.

Laws That Apply

Texas

Duty to protect data: Tex. Bus. & Com. Code § 521.052. A business must implement and maintain reasonable procedures to protect sensitive personal information and destroy records it no longer needs.

Breach notice: Tex. Bus. & Com. Code § 521.053. Affected individuals must be notified without unreasonable delay and no later than 60 days after the business determines a breach occurred. If at least 250 Texas residents are affected, the Attorney General must be notified as soon as practicable and no later than 30 days after the determination. For large breaches, the statute allows substitute notice (for example, email, website posting or statewide media) in certain situations, so do not assume you will receive only a mailed letter.

State enforcement: Tex. Bus. & Com. Code § 521.151. The Attorney General can seek civil penalties, including $2,000 to $50,000 per violation, and up to $100 per individual for each consecutive day of delayed notification, capped at $250,000 per breach. Chapter 521 is enforced by the Attorney General, not by private lawsuits, so private plaintiffs generally rely on other claims. The AG listing alone does not show an enforcement action has been filed.

Deceptive Trade Practices Act: Tex. Bus. & Com. Code § 17.41 et seq. Consumers can sue for deceptive practices, but must generally give 60 days’ written notice before suing (§ 17.505).

Common-law claims. Plaintiffs commonly plead negligence, breach of implied contract and unjust enrichment. Negligence and DTPA claims generally carry a two-year limitations period in Texas (Tex. Civ. Prac. & Rem. Code § 16.003 and Bus. & Com. Code § 17.565), and contract claims four years (§ 16.051), though deadlines depend on the claim and facts.

Federal

Standing: Article III. Federal courts require a concrete injury. In TransUnion LLC v. Ramirez (2021) and Spokeo, Inc. v. Robins (2016), the Supreme Court held that a bare risk of future harm is not enough for damages without concrete harm, and Clapper v. Amnesty International (2013) requires that threatened harm be certainly impending or a substantial risk. Defendants often use these cases in data breach motions to dismiss. Plaintiffs with actual misuse, fraud losses, mitigation costs or confirmed exposure on the dark web generally have stronger positions.

Class actions: Fed. R. Civ. P. 23 and the Class Action Fairness Act, 28 U.S.C. § 1332(d). These govern certification, settlement approval and federal jurisdiction over large class actions.

FTC Act § 5 (15 U.S.C. § 45). The Federal Trade Commission treats unreasonable data security as an unfair or deceptive practice, but the Act gives no private right of action.

Credit freezes and alerts: 15 U.S.C. § 1681c-1. You can place security freezes for free at each nationwide credit bureau, and fraud alerts as well. Texas also has its own security-freeze law (Tex. Bus. & Com. Code ch. 20).

Identity theft: 18 U.S.C. § 1028 and § 1028A. Federal crimes for misusing another person’s identification

What You Should Do Now

1. Look for an official notice by mail or email (check spam). Verify it by contacting CenterPoint through a number or website from a past bill, not the message itself.
2. Freeze your credit free at Equifax, Experian and TransUnion if your Social Security or driver’s license number may be exposed. A freeze does not stop misuse of existing accounts, so keep monitoring.
3. Review your credit reports free at AnnualCreditReport.com and watch bank, card and utility statements.
4. Beware of phishing. Criminals may use exposed names and addresses to pose as CenterPoint, a bank or the IRS. Do not pay unexpected demands by gift card, cryptocurrency or unfamiliar links.
5. Report identity theft at IdentityTheft.gov and keep records of emails, bills and bank statements. Consider an IRS Identity Protection PIN if your Social Security number may be exposed.
6. Keep your notice and proof of being a customer. They may matter if a settlement later requires proof.
7. Be cautious with law-firm ads. A firm offering to review your claim is not a court-approved compensation program.

Key Dates

Date	Event
2023	Earlier, separate incident tied to a third-party file-transfer product
August 19–22, 2026	Incident dates listed in the AG breach record (not independently confirmed by CenterPoint’s filing)
September 2026	CenterPoint learns of an online post claiming customer data
September 9–23, 2026	Seven federal lawsuits filed in S.D. Tex.
September 14, 2026	CenterPoint files Form 8-K confirming unauthorized access
October 13, 2026	Texas AG lists 1,062,060 affected Texas residents
To be determined	Consolidation, motions to dismiss, any class certification or settlement

Frequently Asked Questions

How many people were affected? 

The Texas AG lists 1,062,060 Texas residents. Other states may have additional affected people, and larger figures claimed online are unconfirmed.

What data was exposed? 

Names, addresses, Social Security number information and driver’s license numbers, per the AG listing.

Did CenterPoint confirm the breach?

 Yes, in a September 14, 2026 SEC filing.

Will I get a notice? 

Texas law requires notice to affected individuals within 60 days of the company’s determination. At the time of the AG listing, notice was not yet reported. Check mail and email.

Is my electric or gas service affected? 

CenterPoint says services were not disrupted.

Can I sue?

 You may have options depending on your facts and harm. Texas Chapter 521 is enforced by the Attorney General, and other claims have standing and timing requirements. Consult a licensed attorney.

Should I freeze my credit? 

It is free and a reasonable precaution if your Social Security or driver’s license number may be exposed.

Was payment information exposed? 

The AG listing does not list payment data. The online poster’s claims about billing and payment information are unconfirmed.

Related Coverage on AllAboutLawyer.com

• Brightspeed Data Breach Lawsuit: Are You One of the 1 Million Customers Whose Data Was Stolen?
• Betterment Data Breach Lawsuits: What 1.4 Million Customers Need to Know

Sources

1. Texas Attorney General, Data Security Breach Reports: https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage
2. Texas Attorney General, data breach reporting guidance: https://www.texasattorneygeneral.gov/consumer-protection/data-breach-reporting
3. CenterPoint Energy, Inc., Form 8-K filed September 14, 2026: https://www.sec.gov/Archives/edgar/data/1130310/000110465926107560/tm2625326d1_8k.htm
4. Reuters, “CenterPoint Energy discloses customer data breach in SEC filing” (September 2026): https://capital.com/en-gb/news/centerpoint-energy-discloses-customer-data-breach-in-sec-filing
5. SecurityAffairs, “Texas Utility CenterPoint Energy Confirms Data Breach After Hacker Claims 7.49M Records Stolen”: https://securityaffairs.com/199170/data-breach/texas-utility-centerpoint-energy-confirms-data-breach-after-hacker-claims-7-49m-records-stolen.html
6. CyberInsider, “CenterPoint Energy confirms data breach after hacker claims 7.49M records”: https://cyberinsider.com/centerpoint-energy-confirms-data-breach-after-hacker-claims-7-49m-records/
7. Federal court dockets, S.D. Tex.: Floyd https://dockets.justia.com/docket/texas/txsdce/4:2026cv07567/2108857 · Wyche https://dockets.justia.com/docket/texas/txsdce/4:2026cv07595/2109026 · Curry https://dockets.justia.com/docket/texas/txsdce/4:2026cv07604/2109041 · Sonia https://dockets.justia.com/docket/texas/txsdce/4:2026cv07608/2109066 · Eirwin https://dockets.justia.com/docket/texas/txsdce/4:2026cv07626/2109159 · Lindley https://dockets.justia.com/docket/texas/txsdce/4:2026cv07855/2110790 · Vickers https://dockets.justia.com/docket/texas/txsdce/4:2026cv08191/2111932
8. Texas Business & Commerce Code §§ 17.41 et seq., 17.505, 17.565, 521.052, 521.053, 521.151, ch. 20: https://tcss.legis.texas.gov/resources/BC/htm/BC.521.htm
9. Texas Civil Practice & Remedies Code §§ 16.003, 16.051
10. 15 U.S.C. §§ 45, 1681c-1; 18 U.S.C. §§ 1028, 1028A; 28 U.S.C. § 1332(d); Fed. R. Civ. P. 23, 42
11. TransUnion LLC v. Ramirez, 594 U.S. 413 (2021); Spokeo, Inc. v. Robins, 578 U.S. 330 (2016); Clapper v. Amnesty International USA, 568 U.S. 398 (2013)
12. FTC, IdentityTheft.gov: https://www.identitytheft.gov/

Disclaimer: This article provides general legal information, not legal advice. Allegations are not findings of liability, and the number of affected people and notification status may change as the investigation proceeds.