7.49 million CenterPoint customer records were stolen
Assessment
The 7.49 million figure originates entirely with the threat actor using the alias 4d722e4d656f77, who posted it on a cybercrime forum on September 12, 2026 and offered a 2.5 GB archive. CenterPoint's Form 8-K does not confirm the number, does not confirm the authenticity of the published dataset, and explicitly states the investigation is still determining the scope of affected customers. Two independent outlets that reported the figure both noted they could not fully validate the leaked data and that criminal actors routinely inflate counts or repackage old data. A reader repeating '7.49 million CenterPoint customers breached' as established fact would be repeating an unverified attacker claim as though the company had confirmed it.
Where this claim appeared
Security Affairs (reporting the threat actor's forum claim) · 2026-09-16
https://securityaffairs.com/199170/data-breach/texas-utility-centerpoint-energy-confirms-data-breach-after-hacker-claims-7-49m-records-stolen.htmlWhat “Unverified” means
Widely repeated, but no supporting evidence was located. This is not a statement that the claim is false — it is a statement that nothing published supports it, which is a different and more common problem.
2 of 5 · rating scale
Assessed in
CenterPoint Energy breach: a confirmed intrusion, and a 7.49M-record claim only the attacker is makingThink this assessment is wrong? Report an error.