CenterPoint Energy breach: a confirmed intrusion, and a 7.49M-record claim only the attacker is making

Executive Summary

On September 14, 2026, CenterPoint Energy — a Houston-based electric and gas utility serving roughly 7 million metered customers across Texas, Indiana, Minnesota and Ohio — filed a Form 8-K disclosing that "an unauthorized third party obtained personal information relating to a portion of the Company's customers through one of the Company's external facing systems."¹ The disclosure was triggered not by internal detection but by an online post: two days earlier, a threat actor had begun advertising a CenterPoint customer data set on a cybercrime forum.²³

Almost everything specific that has been reported about this breach — the scale, the mechanism, and the data types — comes from the attacker, not the company. On September 12, an actor using the alias 4d722e4d656f77 (hexadecimal that decodes to "Mr.Meow") claimed to have extracted "well over 7.49 million" customer records and offered a 2.5 GB archive for download.²³ The actor described pulling the data from "an API they managed and controlled, which lacked proper WAF protection, rate limiting, certification protection, and no JWT/Auth token," and claimed the company only tried to stop the extraction partway through — after which, the actor said, a "simple CAPTCHA" was all that prevented pulling "17.44 million" records.² The claimed fields include names, phone numbers, email addresses, service and billing addresses, account and premise identifiers, billing amounts, payment status, and the last four digits of Social Security numbers.²³

CenterPoint's own filing confirms none of this. The 8-K does not name the actor, does not confirm the 7.49 million figure, does not describe how the external-facing system was compromised, and does not enumerate the data fields involved.¹ Independent outlets reported they could not fully validate the leaked dataset, and both noted the standard caveat that criminal actors routinely inflate counts or repackage old data.²³ What is corroborated by the company is narrow: a real breach of customer personal information through an internet-facing system, with electric and gas delivery unaffected and operations undisrupted.¹

Two details in the filing itself deserve attention. First, CenterPoint disclosed the incident under Item 8.01 (Other Events) — a voluntary disclosure slot — rather than Item 1.05 (Material Cybersecurity Incident), and stated it "does not believe it is reasonably likely that there will be a material impact" on its financial condition.¹ That is a materiality determination, not a technicality: the company is telling the market this breach is, as of filing, immaterial. Second, the filing says CenterPoint "reported the matter to law enforcement authorities and has notified certain regulatory authorities," and will notify affected customers "as required by applicable law" — the notification obligations are still ahead of it, because the scope is still unknown.¹

Verification of Claims

1. Claim: An unauthorized third party obtained CenterPoint customers' personal information through an external-facing system. → Verified → CenterPoint's own Form 8-K states this directly: "the Company has determined that an unauthorized third party obtained personal information relating to a portion of the Company's customers through one of the Company's external facing systems."¹

2. Claim: 7.49 million customer records were stolen. → Unverified → The figure is the attacker's own claim, made in a forum post on September 12 and repeated in press coverage.²³ CenterPoint has not confirmed it, independent outlets could not validate the dataset, and the 8-K explicitly leaves the scope undetermined.¹²³

3. Claim: The data was taken from an API lacking authentication, rate limiting and WAF protection. → Unverified → This mechanism is described only by the attacker.² CenterPoint's filing says only "one of the Company's external facing systems" and does not describe how it was accessed.¹

4. Claim: The exposed data included partial Social Security numbers. → Unverified → Reported as an attacker claim (specifically the last four digits) by two outlets; not confirmed in the 8-K, which does not enumerate affected fields.¹²³

5. Claim: CenterPoint's electric and gas service was disrupted. → False → The 8-K states delivery of electric and gas services "has not been impacted and remains operational and undisrupted."¹

Timeline

Attack Anatomy

The mechanics below rest almost entirely on the attacker's own account; the company has not described how its external-facing system was accessed, so this section is the actor's narrative, corroborated only insofar as CenterPoint confirms a breach occurred through an internet-facing system.¹²

Access to an external-facing system

CenterPoint confirms the entry point was "one of the Company's external facing systems."¹ The attacker characterises that system as a company-controlled API and says it required no authentication token to return customer data — "no JWT/Auth token to pull said data" — and lacked a web application firewall, rate limiting, and certificate protection (T1190).²

Automated bulk extraction

The attacker describes a scripted, high-volume pull: "7 files in total of (.jsonl) format, which upholds per line 1 user," amounting to "well over 7.49 million lines," plus a filtered CSV holding "the full PII" (T1119).² The actor claims CenterPoint attempted to interrupt the extraction partway through and that a CAPTCHA challenge was the only control that stopped further pulling — implying the data was returned over ordinary web requests to the API until a challenge was introduced (T1071.001).²

Monetisation and threat

The actor offered a 2.5 GB archive for download on the forum and appended a threat to escalate: "next time we won't simply pull data, we'll start attacking the main infrastructure."² No infrastructure attack has been reported, and CenterPoint states its operational technology and service delivery were unaffected.¹

Threat Actor Profile

• Alias: 4d722e4d656f77 — hexadecimal decoding to the ASCII string "Mr.Meow".²
• Attribution: None. CenterPoint does not name the actor, and no security vendor or government body has attributed the post to a known group or individual.¹²³
• Attribution confidence: Not applicable — the actor is self-identified only by a forum alias.
• Motivation: Financial / notoriety. The actor mocked the target ("It's quite funny to think a $26.2 billion company has WEAK protection"), advertised the data for download, and issued an escalation threat — behaviour consistent with a data-theft-and-extortion or reputation-driven actor rather than a state operation.²
• Sophistication: On the actor's own account, the intrusion required no exploit of a software vulnerability — only the discovery and scripted abuse of an internet-facing API that returned PII without authentication. That is a low technical bar if true; the claim is unverified.²

MITRE ATT&CK techniques (the mapping reflects the attacker's described method, which CenterPoint has not confirmed):

Technical Indicators

# No file hashes, IPs, or network indicators have been published by CenterPoint
# or in the reporting reviewed. This was a data-theft-via-web-API incident, not
# a malware intrusion, and the only concrete artefact is the forum alias.
actor_alias:
  - "4d722e4d656f77"        # hex for the ASCII string "Mr.Meow"
claimed_artifacts:
  - "2.5 GB archive offered for download on a cybercrime forum"
  - "7 x .jsonl files (attacker claim: one user per line) plus a filtered CSV"
network_iocs: none disclosed
file_hashes: none disclosed
note: >
  The record count, data fields, and the "unprotected API" mechanism are the
  attacker's claims, unconfirmed by CenterPoint and not independently validated.

Legal and Regulatory Response

• SEC disclosure: Form 8-K filed September 14, 2026 under Item 8.01 (Other Events), signed by VP and Chief Accounting Officer Russell K. Wright for CenterPoint Energy, Inc. and two subsidiary registrants. The company stated it "does not believe it is reasonably likely that there will be a material impact" on its financial condition or results — a determination that the incident is immaterial as of filing, which is why it appears under Item 8.01 rather than the material-incident Item 1.05.¹
• Law enforcement and regulators: CenterPoint reported the matter to law enforcement authorities and notified "certain regulatory authorities."¹
• Customer notification: Not yet issued. The company intends to notify affected customers and additional authorities "as required by applicable law" once the scope is determined — which, per the filing, it was still working to establish.¹
• Insurance: CenterPoint said it maintains "customary cybersecurity insurance coverage" it believes will offset related costs.¹

Impact Assessment

• Confirmed: A breach of customer personal information through an external-facing system.¹
• Confirmed: No impact to electric or gas service; operations undisrupted.¹
• Reported (attacker claim, unverified): ~7.49 million records; a 2.5 GB archive; fields including names, contact and billing details, account/premise identifiers, and the last four digits of Social Security numbers.²³
• Reported (attacker claim, unverified): The extraction mechanism — an unauthenticated, unthrottled, WAF-less API — and the claim that up to 17.44 million records could have been taken but for a CAPTCHA.²
• Unknown: The actual number of customers and records affected; which data fields were exposed; how the external-facing system was accessed; how long it was exposed; and whether the advertised dataset is authentic. CenterPoint's investigation was still determining scope at the time of filing.¹³

Lessons and Defensive Recommendations

For platform and API security teams:

• The failure mode the attacker describes — an internet-facing API returning bulk PII with no authentication token, no rate limiting, and no WAF — is a broken-object-level / missing-authentication problem, not an exploited software flaw. Inventory every external-facing API that can return customer records, and confirm each enforces authentication, per-account rate limiting, and anomaly detection on bulk reads. A CAPTCHA introduced only after millions of records leave is a control applied at the wrong end of the incident.
• Treat a sudden, high-volume read pattern against a customer-data API as an exfiltration signal in its own right, independent of any malware indicator. In this incident the only "artefact" was the volume of the pull.

For breach responders and disclosure teams:

• When the first sign of a breach is a forum post, the attacker's claimed scale becomes the headline before the company can establish the real one. Have a communications position ready that neither confirms nor amplifies an unverified figure while the investigation runs — CenterPoint's 8-K does exactly this.
• The Item 8.01 vs Item 1.05 choice is a public materiality signal. Filing under 8.01 with an explicit "not reasonably likely to be material" statement is a defensible position for an unquantified breach, but it starts a clock: if the confirmed scope later proves material, the determination has to be revisited.

For CenterPoint customers:

• Assume, pending the company's own notification, that name, address, account details, and possibly the last four digits of a Social Security number may be exposed. Treat unsolicited calls, texts, or emails referencing your account balance or service as potential phishing, and contact CenterPoint only through officially published channels.

Sources