CenterPoint Energy disclosed a breach compromising some customers’ personal information after an attacker leaked data allegedly stolen from the utility company.
An investigation started after the company discovered an online post from a threat actor claiming to have stolen 7.49 million records.
CenterPoint Energy is a Houston-based public utility company that provides electric and natural gas services and operates power generation facilities.
It serves approximately 7 million metered customers across Indiana, Minnesota, Ohio, and Texas, and employs roughly 8,300 people, generating over $9.3 billion in annual revenue.
Earlier this month, a threat actor using the alias “4d722e4d656f77” told BleepingComputer they stole from CenterPoint Energy 7.49 million customer records that include names, phone numbers, service and billing addresses, account numbers, billing amounts, and partial Social Security numbers (SSNs).
The threat actor leaked the data, claiming that the company ignored their messages and treated them as a joke.
According to the intruder, they exfiltrated the data by iterating through millions of IDs on CenterPoint’s public API, which lacked rate limiting, web application firewall (WAF) protection, and other security measures against automated access.