CenterPoint Energy Confirms Data Breach After Hacker Leaks 7.5M Records

A major CenterPoint Energy data breach has been confirmed after a threat actor leaked 7.49 million customer records online, exposing personal information harvested through an unsecured public interface. The Houston-based utility company, which provides electric and natural gas services to roughly 7 million metered customers across Texas, Indiana, Minnesota, and Ohio, acknowledged in a U.S. Securities and Exchange Commission (SEC) filing that an unauthorized third party exfiltrated customer details from one of its external-facing systems.

API Scraping Drives the CenterPoint Energy Data Breach

The incident was brought to light after a threat actor using the alias “4d722e4d656f77” posted online claiming to possess 7.49 million stolen records from CenterPoint Energy. According to statements made by the attacker, the compromise was not the result of sophisticated ransomware or stolen administrative credentials, but rather automated exploitation of a public API endpoint.

The threat actor exfiltrated the dataset by systematically iterating through millions of account IDs. Because the exposed API lacked basic security controls—such as rate limiting, web application firewall (WAF) filtering, and anti-automation protections—automated scripts were able to query the system at scale without being throttled or blocked. The attacker stated that they decided to leak the stolen data publicly after CenterPoint ignored their attempts to make contact, treating their communications as a joke.

The compromised dataset leaked online contains extensive customer details, including full names, phone numbers, billing and service addresses, account numbers, billing amounts, and partial Social Security numbers (SSNs).

Broken Object Level Authorization and Rate Limiting Explained

This incident highlights a classic execution of Broken Object Level Authorization (BOLA)—frequently referred to as Insecure Direct Object References (IDOR)—combined with missing rate-limiting mechanisms. In modern API architecture, BOLA represents one of the most severe and prevalent vulnerability classes because it allows attackers to bypass standard authorization checks simply by manipulating request parameters.

When an API exposes direct database identifiers (such as incremental account numbers) in request paths or payload parameters without verifying whether the requesting user session owns that record, an attacker can substitute their own account ID for any other valid ID. When this logical vulnerability exists alongside a complete lack of rate limiting, an attacker does not even need to hide their activity; they can simply deploy simple multi-threaded scripts to scrape millions of endpoint responses in a matter of hours or days.

For large public utilities managing portals for millions of billing accounts, public APIs often support web dashboards and mobile applications. When these endpoints are published without an API gateway enforcing rate limits, IP throttling, or session context validation, they create an enormous attack surface that can be quietly harvested by trivial scraping scripts.

Operational Impact, SEC Filings, and Class Action Lawsuits

In its formal SEC regulatory filing, CenterPoint Energy confirmed that an unauthorized third party acquired personal information belonging to a portion of its customer base. However, the utility emphasized that its core electric and natural gas operational systems and distribution infrastructure were entirely unaffected by the cyberattack. The company also indicated that it does not expect the breach to have a material financial impact on its overall business operations or financial condition.

Upon discovering the breach, CenterPoint initiated its incident response protocol, engaged third-party cybersecurity specialists to conduct a forensic investigation, strengthened defensive controls across its external systems, and notified law enforcement alongside regulatory authorities.

Despite the operational continuity, the legal consequences are escalating rapidly. Multiple proposed class-action lawsuits have already been filed against CenterPoint Energy in federal court by law firms representing affected consumers. These filings allege that the security breakdown occurred between August 17 and September 1, exposing millions of residents to heightened risks of identity theft, targeted phishing, and social engineering attacks.

Defending Public Utility APIs Against Automated Exploitation

Mitigating automated API harvesting and structural authorization flaws requires utility providers and enterprise defenders to enforce strict controls at the API gateway and application layer:

• Enforce Object-Level Authorization: Ensure every API endpoint performs explicit authorization checks validating that the authenticated session token matches the specific record ID being requested, rather than relying solely on user login state.
• Implement Strict API Rate Limiting: Enforce strict request caps on all public-facing endpoints per IP address, user session, and API key. Rapid-fire requests querying sequential record IDs should immediately trigger HTTP 429 (Too Many Requests) responses and temporary blocklists.
• Deploy WAF Bot Management Controls: Configure web application firewalls and API gateways with behavioral bot detection to identify automated scraping tools, headless browsers, and parameter enumeration attempts even across distributed proxy networks.
• Audit and Inventory External API Surface: Conduct continuous attack surface monitoring to identify undocumented or legacy endpoints, ensuring all exposed APIs adhere to the same security baselines as primary production portals.