The story in brief
- KPRC reported on 14 October 2026 that the Texas Attorney General's database listed 1,062,060 Texans affected by a CenterPoint Energy data breach.
- The reported categories include names, addresses, Social Security information and driver's-license numbers. That does not establish every field was exposed for every individual.
- The filing's notification status was reported as not yet notified at submission. This is a dated filing status, not proof nobody has been notified since.
- Consider free credit freezes, review credit reports and verify utility-related messages independently. CenterPoint told local reporters that electricity and gas delivery remained operational.
What is known about the CenterPoint breach?
The CenterPoint Energy data breach has been reported as affecting 1,062,060 Texas residents. KPRC's 14 October report attributes the precise figure to the Texas Attorney General's public breach database; ABC13 also reports more than one million affected customers and sensitive identifiers.
This is an October disclosure update, not evidence that the attack first occurred in October. KPRC says CenterPoint initially disclosed the incident in a 14 September securities filing after learning of a third party's online claim to possess customer information.
The reported Texas number should not be described as a final nationwide total. Nor does an affected-resident count establish that each person's Social Security number, address and licence number were all exposed together.
Which identifiers are reported as exposed?
KPRC and ABC13 describe the Texas disclosure as including names, addresses, Social Security information and driver's-license numbers. These identifiers justify attention to identity misuse, not just a password reset.
The reporting reviewed does not establish that account passwords, banking credentials or payment cards were exposed. Their absence from the reported category list is not a forensic guarantee that no other information was involved.
Utility-themed phishing could exploit this publicity: an unexpected caller might claim your service will be disconnected unless you make an immediate payment or confirm an identity document. That is a warning about a possible pretext, not a finding that this particular scam has been traced to the breach.
Have affected Texans been notified?
KPRC reported that the listing, published on the Attorney General's website on Monday 12 October, showed affected consumers had not yet been notified when the information was submitted. ABC13's 14 October report also described notifications as outstanding.
A filing is a snapshot. The Attorney General's listing explicitly warns that counts and notification details may change. The evidence reviewed here does not establish the current delivery status of each individual notice or a universal mailing date.
In its 14 October statement quoted by both local outlets, CenterPoint said it was still assessing affected customer data with third-party experts to identify customers who would receive notices under applicable requirements. Check the company's genuine channels rather than an unsolicited breach-compensation message.
Practical identity-theft precautions
The FTC recommends credit freezes and credit-report review when sensitive identifiers may be exposed. These precautions can be taken without waiting for a fraud loss or paying a company to investigate.
- Consider freezing all three credit files. Contact Equifax, Experian and TransUnion separately through their official services. Freezes are free to place and lift and make new-credit identity fraud harder. They do not protect every existing account.
- Review your credit reports. Use AnnualCreditReport.com, the authorised US source, and look for unfamiliar accounts or enquiries. A clean report today does not rule out later misuse.
- Understand a fraud alert. An initial alert asks lenders to verify your identity. Contacting one of the three nationwide bureaus should cause it to notify the other two. It is different from a freeze.
- Use an individual notice. If a genuine notice identifies a driver's-license number or Social Security information as involved, follow the relevant authority's guidance. Do not send a copy of your ID to an unexpected caller.
- Report actual misuse. Use IdentityTheft.gov for a US recovery plan, contact affected financial institutions directly and keep records. Verify utility-account questions through a number on a genuine bill.
Checking your wider exposure
A ProtectMyData exposure scan checks available evidence linked to the email address you choose to submit. It is not definitive proof that you were, or were not, affected by an incident discussed here. A result from another breach does not establish involvement in this one.
Removing information from public websites or data brokers can reduce public exposure. It does not erase breach records, recover stolen copies or replace account-security and fraud-recovery steps. Reading this article does not run a lookup. The optional scan requires you to enter an email and submit the form.
What CenterPoint says about services
The company's statement to KPRC and ABC13 says it activated incident-response procedures and engaged outside cybersecurity, forensic and legal advisers. It says delivery of electric and gas services was not impacted and remained operational and undisrupted.
That is the company's operational statement as reported on 14 October, not our independent audit. Continued electricity or gas service does not settle the confidentiality of customer records. The precise affected-person count comes from reporting of the Texas disclosure, not from a figure in that quoted company statement.
Timeline
Initial disclosure reported
KPRC describes a securities filing in which CenterPoint acknowledged a third-party claim and its investigation. We have not independently inspected that filing.
Texas listing published, according to KPRC
KPRC dates the database publication to Monday and reports 1,062,060 affected Texans and notices outstanding at submission.
Local reports and company response
KPRC and ABC13 describe the listed identifiers and quote CenterPoint's continuing investigation and uninterrupted energy-delivery statement.
What we could verify directly
What we could verify directly
Checked on 19 October 2026: KPRC and ABC13's 14 October reports, the Texas Attorney General's reporting guidance and public listing, and FTC recovery guidance. The public listing we could retrieve did not expose the CenterPoint row in its returned page, so the precise count, listed categories and dated notification status remain attributed to local reporting of the regulatory disclosure.
We have not independently retrieved the underlying CenterPoint regulatory submission or the September securities filing. The September filing description is attributed to KPRC. No attacker dataset was accessed and no assumption is made that every Texas customer has received or will receive the same notice.
Update notes
19 October 2026: First report prepared from the sources listed below. Incident dates and source limitations are distinguished from this publication date.
Questions readers ask
Were 1,062,060 people affected nationwide?
The figure is reported as affected Texans in the Texas disclosure. It is not an established nationwide total.
Does no notification mean I am safe?
No. The filing's notification field describes a point in time. Lack of a notice is not proof that your information was unaffected.
Will a credit freeze stop every type of identity theft?
No. It makes new-credit fraud harder but does not prevent misuse of an existing account or all other identity fraud. Continue reviewing account activity and responding to specific misuse.
Did the breach stop electricity or gas delivery?
CenterPoint's 14 October statement, quoted by local reporters, said delivery was not impacted and remained operational. That statement is separate from the investigation into customer data.
Sources
- More than 1 million Texans affected by CenterPoint data breach, AG report showsKPRC Click2Houston, 14 October 2026
- More than 1 million customers impacted by CenterPoint Energy data breach, AG report filing showsABC13 Houston, 14 October 2026
- Data security breach reportsOffice of the Texas Attorney General, Public listing, checked 19 October 2026; CenterPoint row not independently retrieved
- Credit freezes and fraud alertsUS Federal Trade Commission, August 2025 guidance, checked 19 October 2026
- Identity theft recoveryUS Federal Trade Commission, Consumer recovery service
- Your free credit reportsAnnualCreditReport.com, Authorised US credit-report service
Published 19 October 2026. Last checked and updated 19 October 2026. We do not link to attacker material.
