CenterPoint Energy, a major electric and gas utility, has confirmed a data breach after discovering a dark web post claiming to offer stolen customer data. The Houston-based company filed an 8-K form with the Securities Exchange Commission (SEC) on Monday evening, September 14, 2026, acknowledging that an investigation into the claims revealed unauthorized access to one of its external-facing systems.
The company stated that personal information belonging to a portion of its customers was obtained by hackers. CenterPoint Energy is currently working with third-party experts to determine the full scope of affected customers and the specific types of personal information compromised. It intends to notify impacted customers and relevant regulatory authorities as required by law.
While CenterPoint Energy confirmed the data theft, it declined to comment on specific claims made in the dark web post. The post reportedly alleges that approximately 7.5 million records were stolen, containing details such as customer names, account information, the last four digits of Social Security numbers, and billing information.
CenterPoint Energy emphasized that the incident has not impacted the delivery of electric and gas services to its 7 million customers across Indiana, Minnesota, Ohio, and Texas. The company has reported the incident to law enforcement.
The utility anticipates incurring some costs related to the investigation and remediation efforts, but it does not expect the incident to have a material impact on its financial performance. CenterPoint Energy reported a net income of $244 million in the second quarter of 2026.
This is not the first data breach for CenterPoint Energy. In 2025, the company announced an investigation into a separate 2023 incident where customer information was stolen through a popular file-sharing platform.
