On September 1, 2026 a threat actor posted a database claiming 7.49 million CenterPoint Energy customer records — names, billing addresses, phone numbers, account details and partial Social Security numbers. CenterPoint has not confirmed it. Freeze your credit, add a PIN to your utility account, and treat any unexpected CenterPoint call as a scam until you verify it.
What Happened
On September 1, 2026, an actor using the alias "4d722e4d656f77" posted on an open web forum claiming to have a CenterPoint Energy customer database. The listing described roughly 7.49 million raw records and 6.73 million filtered records, and sample data was provided alongside a claim that the full dataset was downloadable.
According to the listing and subsequent reporting, the data includes:
- Customer names
- Phone numbers
- Service addresses and billing addresses
- Account numbers and premise IDs
- Billing amounts and payment status
- Service details, autopay status and paperless billing status
- Partial Social Security numbers
CenterPoint Energy has not publicly confirmed the breach or its scope. Reporting has linked the claimed dataset to the utility's earlier exposure through the 2023 MOVEit file transfer campaign, which affected hundreds of organisations. Multiple plaintiffs' firms, including Edelson Lechtzin LLP and Shamis & Gentile P.A., have opened class-action investigations.
Unconfirmed Does Not Mean Untrue — or Confirmed
At the time of writing the company has not validated the dataset, and independent verification of a 7-million-record claim takes time. The sensible posture is precautionary: the protective steps below are free, reversible, and worth doing whether or not this specific listing is genuine.
Who Could Be Affected
CenterPoint Energy serves electric and natural gas customers across Texas (including the Houston metro), Indiana, Minnesota, Ohio and Louisiana. If you have held a CenterPoint account in recent years — including one you have since closed — you fall inside the plausible scope. Closed accounts matter here: utilities retain billing records long after service ends.
Why Utility Data Is Worth Stealing
A utility record is not a credit card number, and that is exactly why it is useful to criminals. It is proof-of-address data, which is the missing piece in most identity fraud attempts.
- Account takeover and verification bypass. Your name paired with a service address, account number and partial SSN is enough to pass many call-centre identity checks.
- Utility-bill-as-ID fraud. A utility statement is widely accepted as proof of residence when opening bank accounts or applying for services. Account details make forging a convincing one straightforward.
- Highly credible scam calls. A caller who can state your exact balance, autopay status and premise ID does not sound like a scammer. That is the core risk in this dataset.
- Address confirmation for other fraud. Combined with the date of birth and relatives available from people-search sites, a confirmed current address completes a synthetic identity profile.
Step 1: Freeze Your Credit at All Three Bureaus
Free, and the strongest single control. A freeze blocks new credit accounts in your name until you lift it.
- Equifax: equifax.com/personal/credit-report-services
- Experian: experian.com/freeze
- TransUnion: transunion.com/credit-freeze
Freeze all three — different lenders pull from different bureaus — and store the PINs where you can retrieve them.
Step 2: Add a PIN or Password to Your CenterPoint Account
Log in to your CenterPoint account, change the password to something unique, and enable two-factor authentication if it is offered. Then call customer service and ask to place an account PIN or verbal password on the file, so that no one can transfer service, change the mailing address, or request a payment arrangement over the phone without it. Do the same with any other utility, because leaked service addresses are frequently reused against other providers.
Step 3: Treat Every Utility Call and Text as Hostile
Utility impersonation is the most common fraud that follows a leak like this. The script is always the same: your account is past due, disconnection is imminent, pay immediately by prepaid card, digital wallet, crypto, or a payment app.
What a Real Utility Never Does
CenterPoint will never demand payment by prepaid debit card, gift card, cryptocurrency, Zelle or Venmo, never threaten disconnection within the hour, and never ask you to confirm your full Social Security number on an inbound call. If a call makes you feel rushed, hang up and dial the number printed on your bill.
Is your data already out there?
Leaked data ends up on broker sites and in scammers' hands. Run a free 60-second scan to see your exposure — then let us remove it.
Run a free scan★★★★★ 4.8/5 · Trusted by thousands of families
Step 4: Watch for Partial-SSN Abuse
Partial Social Security numbers sound harmless. In practice, the last four digits are the exact field most call centres use to verify identity — and when the same person appears in several breaches with different partial fragments, the full number can be reconstructed. Watch for:
- New accounts, loans or credit inquiries you did not initiate
- Unemployment or benefits claims filed in your name
- An IRS notice about a tax return you did not file
- Medical bills for care you never received
Step 5: Pull Your Credit Reports and Read the Address Section
Get all three reports free at annualcreditreport.com — the only federally authorised source. Most people check the accounts list and stop. Also read the addresses on file and the inquiries section: an unfamiliar address is often the earliest visible sign that someone is building credit in your name from a different location.
Step 6: Document Everything and Watch the Litigation
Several firms are investigating class actions. If a settlement eventually arrives, claims typically require proof — so keep a folder now: any notice CenterPoint sends, screenshots of suspicious calls or texts, and records of any fraud you experience along with the hours you spent resolving it. Do not pay anyone who contacts you offering to "register" your claim; legitimate settlement claims are always free to file.
Step 7: Remove the Data That Makes This Worse
A leaked utility record is dangerous in combination. On its own, a service address is limited. Paired with the date of birth, phone numbers, email addresses, past addresses and named relatives that data brokers and people-search sites publish openly, it becomes a complete identity profile — enough to pass knowledge-based verification or write a convincing scam script.
You cannot pull the CenterPoint dataset back off a forum. You can remove the surrounding data that gives it leverage.
How PrivacyOn Reduces Your Exposure
PrivacyOn finds and removes your personal information from 100+ data broker and people-search sites, and keeps removing it as those sites rebuild your listing from public records. You also get dark web monitoring that alerts you when your details appear in leaked datasets like this one, 24/7 exposure monitoring, and family plans for up to 5 people — which matters here, since a household utility account exposes everyone at the address. Plans start at $8.33/month. Run a free scan to see exactly which sites are publishing your address and phone number today.
Frequently Asked Questions
Has CenterPoint Energy confirmed this data breach?
No. As of mid-September 2026 CenterPoint had not publicly confirmed the breach or its scope. The claim originates from a September 1 forum post offering roughly 7.49 million records with sample data, and reporting has tied it to the company's 2023 MOVEit exposure. Take precautionary steps regardless — they are free and reversible.
How do I know whether my CenterPoint account is in the leak?
There is no public lookup tool, and CenterPoint has not sent notifications for this claim. If you have held a CenterPoint electric or gas account in Texas, Indiana, Minnesota, Ohio or Louisiana in recent years — including a closed one — assume you may be included and act accordingly.
What can someone do with my utility account information?
Utility records are proof-of-address data. They let a fraudster pass call-centre verification, forge a utility bill for use as ID when opening accounts, and run convincing disconnection scams by quoting your real balance and account details. Combined with data from people-search sites, they help complete a synthetic identity profile.
Are partial Social Security numbers actually a risk?
Yes. The last four digits are the single field most commonly used for phone identity verification. And because the same person turns up in multiple breaches exposing different fragments, partial numbers can be stitched into a full SSN over time. Treat a partial-SSN exposure as a reason to freeze your credit.
Should I close my CenterPoint account?
No — closing it does not delete the data, and utilities retain billing records on closed accounts anyway. Securing the account is far more effective: unique password, two-factor authentication where available, and a verbal PIN on the file so nobody can change your service or mailing address by phone.
How can I tell a real CenterPoint call from a scam?
Assume the inbound call is fake and verify outbound. Hang up and dial the number on your paper bill or statement. No real utility demands payment via gift card, prepaid card, crypto or a payment app, threatens same-hour disconnection, or asks for your full Social Security number on a call it placed to you.