Introduction
Imagine opening your mailbox and finding a letter from your electric company. You expect another bill, perhaps an update about your service, or maybe a notice about an upcoming rate change. Instead, the letter says your personal information may have been stolen in a cyberattack.
Wait a minute. How can that happen to your electric company?
Most of us don’t think twice about providing personal information when setting up electricity, gas, or other household utilities. After all, we need those services, and the companies need to verify who we are so they can provide accurate service.
Unfortunately, that information can become a target for cybercriminals. A recent breach involving CenterPoint Energy demonstrates just how much sensitive information utility companies may have about their customers.
More Than One Million Texans Affected
In September 2026, CenterPoint Energy disclosed that someone had gained unauthorized access to customer information through one of its internet-facing systems. The Houston-based company provides electricity and natural gas services to millions of customers.
CenterPoint discovered the incident after someone posted online claiming to possess company customer information. CenterPoint investigated and confirmed that an unauthorized party had obtained personal information, at which point, they reported the breach to the Texas Attorney General’s office and appropriately filed with the Securities and Exchange Commission (SEC).
The breach affected 1,062,060 Texas residents. Compromised information included names, addresses, Social Security information, and driver’s license numbers.
Fortunately, CenterPoint reported that its electric and gas services continued operating normally. Unfortunately, uninterrupted electricity doesn’t mean customers’ personal information remained safe.
Why Would Criminals Want Utility Customer Information?
Think about what someone might need to open a new account, apply for a loan, or pretend to be somebody else.
A name? An address? A Social Security number?
Those are exactly the kinds of details that make identity theft possible.
Unlike a stolen password, your Social Security number isn’t something you can reset. Criminals may use stolen personal information to impersonate you, attempt to open fraudulent accounts, or create convincing scams.
For example, imagine receiving a phone call from someone claiming to represent your electric company. They know your name and address, so the call seems legitimate. They tell you there’s a problem with your account and request additional information to verify your identity.
Would you trust them?
Unfortunately, having accurate information about you doesn’t prove someone is who they claim to be.
What If You Never Receive a Breach Notification?
When CenterPoint reported the incident to Texas authorities in October, the company was still working to determine which customers needed to know about the situation. That means some people potentially affected by the breach hadn’t yet received a warning.
What does that mean for you, as a user (in this case or any other)? Cybersecurity incidents don’t always become clear immediately.
Companies may need time to investigate what happened, determine which information was involved, and identify affected customers. In the meantime, criminals already possess that stolen information.
That’s why it’s worth paying attention to reports about breaches involving any organizations that hold your personal details.
How Can You Protect Yourself After a Data Breach?
If you discover that a company holding your information experienced a breach, don’t panic. Instead, take a few practical precautions.
- Consider freezing your credit. A credit freeze can make it harder for criminals to open new credit accounts using your identity.
- Monitor your financial accounts. Watch for unfamiliar transactions, accounts, or changes to your credit reports.
- Be cautious about unexpected calls. Never assume someone represents your utility company simply because they know your personal information.
- Verify messages independently. Use the phone number printed on a legitimate bill or listed on the company’s official website.
- Follow official breach instructions. If you’re notified that your information was exposed, review the company’s recommendations and any available identity protection services.
For work-related accounts, report suspicious messages or unexpected requests for sensitive information to your IT department.
Conclusion
We usually associate cyberattacks with banks, online shopping accounts, and technology companies. Unfortunately, almost any organization that stores personal information can become a target.
The CenterPoint Energy breach reminds us that even the companies providing our most basic household services may hold information criminals would love to obtain.
Pay attention to breach notifications, protect your personal details, and question unexpected requests for sensitive information.
Your electricity might keep working after a cyberattack, but protecting your identity could require a little more effort.
