7 Million CenterPoint Energy Customers Just Had Their Driver's License Numbers Stolen

Your Electric Company Has Been Holding Your Driver's License This Whole Time

You pay your power bill. You don't think twice about what CenterPoint Energy stores on their servers. Most people don't.

On September 14, 2026, CenterPoint filed an SEC Form 8-K confirming what a hacker had already posted on a public forum: an unauthorized third party accessed millions of customer records through an external-facing system. The stolen data includes customer names, phone numbers, email addresses, billing and service addresses, account numbers, billing amounts and due dates, driver's license numbers, and the last four digits of Social Security numbers.

Your utility company. Your driver's license.

How Did This Actually Happen?

The hacker claims they pulled the data through an API endpoint, essentially a door on the internet that lets software talk to CenterPoint's systems. That door had no lock.

No authentication token. No web application firewall. No rate limiting. No certificate checks.

To be clear about what that means: anyone who found that door could walk in and take everything. There was no password to guess, no security system to defeat. The hacker reportedly pulled 7.49 million raw records. Filtered for duplicates, that comes to approximately 6.73 million unique customers.

This is not a sophisticated nation-state attack. This is a missing lock on a door that should never have been open.

The Numbers Behind the Breach

CenterPoint serves customers across Texas, Indiana, Minnesota, Ohio, and other US states. The company has not independently confirmed the full 7.49 million figure and says it is working with outside experts to determine the complete scope.

What CenterPoint did confirm: customer names, contact information, billing details, driver's license numbers, and partial Social Security numbers were exposed. The hacker posted this data publicly before the company's disclosure, which means some of it has already circulated.

Class action lawsuits were filed against CenterPoint within days of the public announcement.

Why Does a Power Company Even Have Your Driver's License?

Utilities collect driver's license numbers and partial SSNs at account setup to verify identity and run credit checks. It's standard industry practice. Most customers have no idea this happens. There's no moment where the signup flow says "we're storing your government ID number indefinitely alongside your billing history."

That data sits in a database, often for the life of the account and sometimes beyond. You move. You close the account. The data doesn't move with you.

This breach reveals a mismatch that runs across the entire utility sector: companies collect sensitive identity data for a one-time verification purpose, then keep it forever in systems that don't receive the same security investment as a bank or healthcare provider.

What You Should Do Right Now

1. Freeze your credit at all three bureaus. Equifax, Experian, and TransUnion all allow free credit freezes. A freeze blocks anyone from opening new credit accounts in your name. Unfreeze temporarily when you need to apply for something. This is the single highest-leverage action you can take after any breach involving partial SSNs.

2. Place a fraud alert. If you'd rather not freeze, a fraud alert requires lenders to verify your identity before issuing credit. It's free and lasts one year. Contact any one bureau and they notify the others.

3. Watch your existing accounts for unusual activity. Stolen billing amounts and account numbers are useful for social engineering. A caller who knows your last payment amount sounds more credible. Be skeptical of anyone contacting you claiming to be from CenterPoint or a collections agency.

4. Monitor for phishing. Your email address and phone number are now potentially in criminal hands. Expect messages that look like they're from your utility. Verify by going directly to CenterPoint's official website or calling the number on your bill. Never click links in unexpected emails about your account.

5. Check your mail. CenterPoint says it intends to notify affected customers by mail as required by law. Watch for that letter. It will likely include instructions for free credit monitoring. Take them up on it.

6. Consider an identity protection service. Several services monitor the dark web for your personal information and alert you when your data appears. Many are free at the basic tier.

The Problem Is Bigger Than CenterPoint

Every company you do business with, your insurer, your landlord, your gym, your electric company, quietly accumulates a dossier on you. They collect what they need in the moment, and they keep it. Most of that data sits in systems that receive far less security scrutiny than a financial institution.

The incentives are broken. Collecting data is cheap. Securing it properly is expensive. And the cost of a breach lands on customers, not always on the company that failed to protect them.

Regulations are catching up, slowly. But until data minimization, collecting only what's needed and deleting it after, becomes a legal requirement with real teeth, this cycle continues.

Do this now:

• Freeze your credit at Equifax, Experian, and TransUnion (free, takes under 10 minutes each)
• Set up fraud alerts if you need your credit accessible
• Be suspicious of any contact claiming to be from CenterPoint in the coming weeks
• Watch for CenterPoint's official notification letter with free monitoring details
• Assume your email and phone number are in active circulation

Sources

• helpnetsecurity.com
• securityaffairs.com