Threat Intel
CenterPoint Energy Breach: 7.5 Million Customer Records Exposed via Unsecured Public API
Houston‑based utility CenterPoint Energy confirmed that an attacker stole and leaked 7.49 million customer records, including names, phone numbers, addresses, account numbers, billing amounts and partial SSNs. The intruder accessed the data by repeatedly querying a public API that lacked rate limiting, a web application firewall and other safeguards. CenterPoint has filed with the SEC, is working with third‑party experts, and has already faced class‑action lawsuits. The company reports that electric and gas services remain unaffected and believes the breach will not materially impact its finan
CenterPoint Energy, a Houston‑based public utility that serves roughly seven million customers across four states, has confirmed a data breach that exposed personal information for millions of its customers.
What Happened
In a post on an anonymous forum, a threat actor—using the handle “4d722e4d656f77”—claimed to have stolen 7.49 million records from CenterPoint. The data set included names, phone numbers, service and billing addresses, account numbers, billing amounts and partial Social Security numbers.
How the Attack Worked
The attacker exploited a publicly accessible API that lacked rate limiting and a web application firewall. By iterating through millions of customer IDs, the intruder was able to pull large volumes of data with little resistance.
Company Response
CenterPoint filed a notice with the U.S. Securities and Exchange Commission, acknowledging that an unauthorized third party accessed personal information via one of its external‑facing systems. The filing states that the company is “continuing to work with third‑party experts to determine the scope of customers and personal information affected” and will notify affected parties and regulators as required by law.
"While the investigation remains ongoing, the Company has determined that an unauthorized third party obtained personal information relating to a portion of the Company’s customers through one of the Company’s external‑facing systems," the SEC filing reads.
CenterPoint has activated its incident‑response procedures, hired external cybersecurity consultants, bolstered system defenses, and reported the incident to law enforcement and regulatory bodies. It maintains that its electric and gas services were not disrupted and that the breach will not materially affect its business or financial condition.
Legal Fallout
Law firms representing potentially impacted customers have already filed class‑action lawsuits in federal court, alleging the breach occurred between August 17 and September 1. The lawsuits seek damages for the exposure of sensitive personal data.
Customers who may have been affected are advised to monitor their accounts for suspicious activity and consider placing fraud alerts on their credit reports.
Related articles
Chinese Hacker Uses ARTEX AI and Claude Agents to Target South Korean Banks
A Chinese-speaking hacker launched attacks on South Korean banks using ARTEX AI and Claude agents, exposing customer data and causing outages. The attacks targeted Shinhan, KB Kookmin, and Hana banks, revealing LLM-based probing techniques. Defenders should audit for ARTEX AI usage, secure exposed directories, and monitor LLM API traffic.
Read briefing
August 10th Threat Intelligence Roundup: Ports Breach, Scooter Data Leak, Crypto Wallet Theft, AI Code Flaws, and Vendor Patches
This week’s bulletin highlights a cyberattack on North Carolina Ports that forced manual operations, a data breach at Scandinavian scooter operator Ryde exposing millions of customer records, and a massive theft from Coldcard wallets that cost Coinkite $88 million. UK charity CRM Beacon suffered a data leak after an access key was compromised. Researchers uncovered critical vulnerabilities in Cloudflare’s Code Mode, Google Gemini CLI, and Anthropic Claude Code, plus new AI‑powered identity fraud kits. Cisco, WordPress, TP‑Link, and Zbtlink vendors pushed patches for high‑severity flaws, while
Read briefing
Brevo Supply‑Chain Breach: Cloudflare Key Theft Fuels ClickFix Malware Injection
Brevo’s hard‑coded Cloudflare API key fell into attackers’ hands, enabling a malicious Cloudflare Worker that ran for over five hours on September 14. The worker injected ClickFix scripts into Brevo’s own sites and the JavaScript libraries customers embed on their pages, distributing a backdoor WordPress plugin and other malware. Affected sites include brevo.com, sendinblue.com, and several customer‑facing URLs. Brevo quickly revoked the key, removed the Worker, and purged edge caches, but up to 100 000 third‑party sites may have been compromised. The incident underscores the risk of embedding
Read briefing
August 24th Threat Intel: Latvia Breach, AI‑Driven Attacks, and Critical Vulnerabilities
The latest Check Point research bulletin highlights a sweeping data breach at Latvia’s Road Traffic Safety Directorate, affecting over 1.2 million citizens and 200,000 organisations. Sakura Internet exposed up to 1.36 million customer accounts through a compromised rental‑server environment. A Canadian children’s hospital suffered a third‑party data leak, while Berlin’s urban ministries were isolated after a security incident. AI‑driven threats are on the rise: an autonomous GitHub Actions agent stole Snowflake tokens, and U.S. authorities warn of AI‑assisted attacks on Siemens S7 industrial c
Read briefing