A Texas based energy company, CenterPoint Energy, admitted a third party stole customer information.
The company became aware of the data breach after a cybercriminal, using the alias "4d722e4d656f77", posted on a cybercrime forum that they were able to extract nearly 7.5 million customer records from the company.
The cybercriminal stated the stolen information includes names, phone numbers, service and billing addresses, account numbers, billing amounts, payment status, and partial Social Security numbers. The poster offered a 2.5 GB archive for download and warned "next time we won't simply pull data, we'll start attacking the main infrastructure".
According to the post, the data was exfiltrated by iterating through millions of IDs on the company's public APIs. These allegedly lacked rate limiting, web application firewall protection, and other security measures protecting against automated access.
The post also alleged that CenterPoint Energy ignored the cybercriminal's messages about the breach, treating them like a "joke", which led them to leak the data.
After becoming aware of the post, CenterPoint Energy stated it locked down its systems. No energy services are said to have been affected by the breach.
After the post was discovered, the company made a filing with the Securities and Exchange Commission but did not confirm or deny that the post was correct regarding the number of records exposed or what information was stolen.
Source: https://securityaffairs.com/199170/data-breach/texas-utility-centerpoint-energy-confirms-data-breach-after-hacker-claims-7-49m-records-stolen.html; https://www.bleepingcomputer.com/news/security/centerpoint-energy-confirms-customer-data-stolen-in-cyberattack/
Commentary
In this case, the company was not able to detect and contain the data breach before it became public. It seems it was not aware of the breach until the cybercriminal posted about it on the dark web.
Further, the company appears to have assumed that alleged messages from the attacker prior to the post were not legitimate, and ignored the messages.
This led to a very public data breach. If the allegations about failing to take threat messages seriously are true, reputational damage for the company for failing to investigate internally before the stolen information was published can be expected.
According to IBM's 2025 Cost of a Data Breach Report, the average data breach takes 241 days to identify and contain. That means most breaches are undetected for about eight months. In that time, data can be stolen, malware can spread, persistent access can be established for prolonged theft, and more.
Cybercriminals go to great lengths to ensure their attacks are not detected, so it is not uncommon for organizations to learn of a data breach after systems have already been affected. Even the best cybersecurity and prevention measures may not stop all attacks.
However, the cost of the breach increases, and organizational reputation is increasingly damaged when organizations ignore threat messages after a breach, leading to the stolen data being posted on the dark web.
The final takeaway is cybersecurity measures to prevent data breaches are important, but equally important is how organizations react to potential threats.
Source: https://www.huntress.com/blog/data-breach-statistics; https://www.sentinelone.com/cybersecurity-101/cybersecurity/data-breach-statistics/#data-breach-detection-and-containment-statistics
