CenterPoint Energy

CenterPoint Energy confirmed a data breach after a hacker claimed on a dark web forum that 7.49 million customer records had been taken. Three proposed class actions followed within days.

The 7.49 million figure is the poster's claim. CenterPoint has confirmed that customer personal information was exposed without publicly adopting that number. Those are two different statements and this report keeps them apart.

The class action filings allege names, phone numbers, addresses, billing information and Social Security numbers. The lawsuits single out the company's guest bill pay feature as the point of access.

Guest bill pay exists so somebody can settle an account without logging in, usually by entering an account number and a postal code. It is a deliberately low friction path into billing records, and low friction for a customer in a hurry is low friction for anyone enumerating account numbers.

Utility customers, which is close to a census of a service territory. People do not choose their electric and gas provider, so the exposed population had no opportunity to assess the company's security before handing over their details.

Social Security numbers in a utility record exist because of credit checks at account opening. The customer supplied one identifier, once, years ago, to prove they would pay a bill. It is still there, and it is the field that turns a billing leak into identity fraud.

Offering guest payment is a customer service decision that most utilities make, and for good reasons. Requiring account registration to pay a bill increases late payments and disconnections, which harms exactly the customers least able to absorb either.

The assumption worth examining is that a payment path needs to return account detail. Confirming an amount owed against an account number is a narrow function. Returning the name, address and billing history attached to that account is a convenience that turned a payment form into a lookup service.

That a low friction payment feature could reach records containing Social Security numbers. Guest bill pay was almost certainly assessed as a billing function rather than as an interface to the customer master record.

This is the same shape as the Manchester Airports entry earlier in this series. A system built for one narrow purpose accumulated reach into a much larger dataset, each connection added for a defensible reason, and nobody summed them.

The gap between confirming exposure and confirming scope is where CenterPoint now sits. A claim of 7.49 million is public, the company has confirmed something happened, and the number it can defend has not been published.

No named group. The claim appeared on a dark web forum rather than a ransomware leak site, and no extortion demand has been reported publicly.

That pattern usually means resale rather than extortion, which removes the deadline and removes the pressure to negotiate. It also removes the victim's opportunity to learn the scope from the attacker, leaving the company to establish it alone while class actions proceed.

Scoping the guest payment path so that it can confirm a balance without returning the customer record behind it. A form that answers how much is owed does not need to answer who lives there.

Second, not holding the Social Security number after the credit decision. A utility needs that identifier once, at account opening. Retaining it for the life of the account is the choice that decides whether a billing system breach is an inconvenience or a fraud event, and it is a choice that can be reviewed by looking at what the billing tables actually contain.