On September 1, 2026, a threat actor posted on a dark web forum claiming to have obtained customer data from CenterPoint Energy, the Houston based electric and gas utility that serves roughly 7 million metered customers across Texas, Indiana, Minnesota and Ohio. The post alleged a database of approximately 7.49 million raw records, described by some plaintiffs as about 6.7 million filtered unique customers, containing names, phone numbers, email addresses, billing and service addresses, account and premise numbers, billing amounts, autopay status, and the last four digits of Social Security numbers. Before CenterPoint issued any public statement, at least five proposed class actions were filed in federal court between September 10 and September 13 on behalf of customers in Texas, Indiana and Minnesota. Several complaints allege the breach traced to CenterPoint's guest bill pay feature, which plaintiffs say returned a range of personal account information once a customer number was entered, without further authentication. CenterPoint has not confirmed or disputed that specific allegation. The company filed an 8-K with the Securities and Exchange Commission on September 14, confirming an unauthorized third party obtained personal information through an external facing system, while saying electric and gas delivery service was unaffected and that it had not independently verified the attacker's claimed record count. CenterPoint said it would notify affected customers and regulators as its investigation continues.