If you’re a CenterPoint Energy customer in Texas, your name, address, Social Security information, and driver’s license number may be in the hands of criminals. The utility’s own filing with the Texas Attorney General says the August breach affected 1,062,060 Texas residents — and a law-firm source says notification letters only started going out on Oct 13, 2026, which means you may not have heard a word from the company yet.
Don’t wait for a letter. The three things to do today: freeze your credit at Equifax, Experian, and TransUnion (free under federal law), get an IRS Identity Protection PIN at irs.gov, and set up a fraud alert with one bureau. Everything below is the full checklist — what happened, what the stolen data lets criminals do, how to block each move, and which scams to expect next.
What Actually Happened: The Timeline
CenterPoint Energy is the Houston-based utility that keeps the lights on for millions of Texans (and serves customers in Indiana, Ohio, and Minnesota too). Here’s how this unfolded, separated into what’s confirmed by the company or state records versus what’s only an attacker’s claim.
| Date | What happened | Status |
|---|---|---|
| Aug 19–22, 2026 | Unauthorized access to CenterPoint’s external-facing systems | Confirmed (TX AG filing) |
| ~Sept 1–12, 2026 | Threat actor posts about a stolen CenterPoint dataset on a cybercrime forum; claims ~7.49 million records from a public API with no rate limiting | Attacker claim — not confirmed by the company |
| Sept 9, 2026 | CenterPoint says it discovered the breach | Confirmed (TX AG filing) |
| Sept 14, 2026 | CenterPoint files SEC Form 8-K: “an unauthorized third party obtained personal information relating to a portion of the Company’s customers through one of the Company’s external facing systems” | Confirmed (SEC filing) |
| Within days | Class action lawsuits filed in federal court on behalf of customers | Confirmed (BleepingComputer reporting) |
| Oct 13, 2026 | Texas Attorney General publishes CenterPoint’s filing: 1,062,060 Texas residents affected; 1,611,625 people in total across all records | Confirmed (TX AG database) |
| Oct 13, 2026 | A data-breach law firm (Cole & Van Note) says CenterPoint began notifying affected individuals | Claimed by a law firm — not independently confirmed by the company |
The AG filing is the only official count, and it names the specific data involved: names, addresses, Social Security number information, and driver’s license numbers. One important caveat from the state record itself: it doesn’t say whether complete or partial Social Security numbers were involved, and it doesn’t show whether every affected person had all four categories exposed. The Texas figure is also a state count — CenterPoint serves four states, so the 1,611,625 total from state records is the broader number to keep in mind.
The 7.49 million figure and the “no rate limiting” detail come from the threat actor’s own forum post (reported by BleepingComputer, SecurityWeek, and others). CenterPoint has never confirmed the count, the dates, the method, or the contents of that file. Treat it as a claim. But here’s the uncomfortable part: the company’s confirmed numbers (names, addresses, SSN data, DL numbers) are already the crown jewels for identity theft. Even if the attacker’s bigger number is wrong, the smaller confirmed number is bad enough.
The Notification Gap: Why No Letter Doesn’t Mean You’re Safe
Here’s what makes this breach unusual and worth acting on immediately. The Texas AG filing showed that CenterPoint had not yet notified affected customers when it submitted its report. A data-breach firm later reported that notification began on Oct 13, 2026 — but the company itself hasn’t publicly confirmed that mail is moving.
Texas law generally requires organizations to report breaches affecting at least 250 state residents to the attorney general and to notify affected individuals without unreasonable delay. Notification this late, after discovery in early September, is exactly the kind of timeline that drew the class actions filed within days of the SEC disclosure.
What this means for you practically:
- Got a letter? Read it carefully, keep it, and work the checklist below. The letter documents which of your data fields were exposed and may offer free credit monitoring — take the monitoring if offered (it costs you nothing), but don’t mistake it for protection. It only watches.
- No letter? Don’t assume you’re fine. With 1.06 million Texans in the file and notices potentially rolling out in batches — or not at all yet — the absence of a letter tells you nothing. Assume exposure until you can rule it out.
- Got a text or email “from CenterPoint” about the breach? As of this writing, the company has only spoken about paper notification and regulator filings. Treat any emailed or texted “breach notice” as a scam until proven otherwise. A real notice letter will never ask for your password, Social Security number, or a payment.
The bottom line: the notification gap doesn’t change what you should do. It only means you have to protect yourself instead of waiting for the company to hand you a plan. Which brings us to the checklist.
The Checklist: What to Do Right Now
Do these in order. Steps 1–4 take about an hour total and close the biggest doors criminals can walk through with your SSN and driver’s license number. Nothing here costs money — every single step is free, and several are rights guaranteed by federal law.
1. Freeze your credit at all three bureaus (the single most important step)
A credit freeze stops new lenders from pulling your credit file, which blocks identity thieves from opening credit cards, loans, or accounts in your name. It’s free under federal law (since 2018), it doesn’t touch your credit score, and you can lift it in about an hour whenever you need to apply for credit yourself.
You must freeze at each bureau separately — one freeze does not cover the others. Online is fastest (the freeze is usually active within a day), but phone works too:
- Equifax: equifax.com/personal/credit-report-services/credit-freeze/ or 1-888-298-0045
- Experian: experian.com/freeze/center.html or 1-888-397-3742
- TransUnion: transunion.com/credit-freeze or 1-888-909-8872
Save the PIN or account password each bureau gives you — you’ll need it to lift the freeze later. And don’t get upsold: Equifax, Experian, and TransUnion each sell paid “credit lock” products that sound similar. A lock is a paid product. A freeze is free, federal law says so, and a freeze is what you want. Learn how a freeze interacts with your score over time in our VantageScore 4.0 breakdown.
One more thing people skip: if you have kids, freeze their credit too. Child identity theft often goes undetected for years because nobody checks a minor’s file.
2. Add a fraud alert (cheap insurance on top of the freeze)
A fraud alert tells lenders to verify your identity before granting new credit. It’s also free. The practical difference from a freeze: it doesn’t block new accounts, it just adds an ID-check step — weaker than a freeze, but useful as a companion layer. An initial alert lasts one year (identity-theft victims can get an extended alert lasting seven years). The nice part: you only have to contact one bureau, and they’re required to notify the other two. If you’re applying for credit soon and don’t want the friction of thawing a freeze three times, a fraud alert at minimum is non-negotiable.
3. Get an IRS Identity Protection PIN
This is the one most breach checklists bury too deep. Your Social Security number was in this file, and the most valuable single use of a stolen SSN is filing a fraudulent federal tax return and stealing the refund. An IRS Identity Protection PIN is a six-digit number known only to you and the IRS — the IRS rejects any e-filed return under your SSN without it. A new one is generated each calendar year.
Get it at irs.gov/getanippin (look for “Get an IP PIN”). The fastest path is through an IRS Online Account; it takes a few minutes once your identity is verified. If you can’t verify online, you can apply by mail with Form 15227 or in person at a Taxpayer Assistance Center, though that takes weeks. Two warnings: once you opt in, you can’t opt out — you’ll need the new PIN every year, so don’t lose it. And the IRS will never call, email, or text you asking for your IP PIN. Anyone who does is a scammer.
4. Freeze ChexSystems and Innovis — and NCTUE if you can
The big three bureaus cover credit. But criminals with your SSN, address, and DL number can also open bank accounts and take out utility or phone service. Two lesser-known reporting agencies matter here:
- ChexSystems tracks your banking history — checking accounts, overdrafts, closures. Banks pull it before opening new accounts. Request a security freeze at chexsystems.com (security freeze section) or 1-800-428-9623.
- Innovis is a fourth credit bureau most people have never heard of; some lenders pull it instead of the big three. Manage a security freeze at innovis.com or 1-866-712-4546.
And one that’s tailor-made for a utility breach: the National Consumer Telecom & Utilities Exchange (NCTUE) collects and shares payment history for utility, phone, and cable accounts. Utility fraud — opening gas, electric, or phone service in your name — runs through this file. You can freeze it by calling 1-866-349-5185. It’s free and lasts indefinitely.
5. Deal with your Texas driver’s license situation
A stolen driver’s license number is worse than most people realize. It’s used for synthetic identities, to pass bad checks, to open accounts that accept a DL as primary ID — and you can’t “freeze” a license number the way you freeze credit.
If your DL number was in the breach, you may be able to get a brand-new number issued, which cuts the thief’s lifeline. Here’s how Texas handles it, straight from the Texas Department of Public Safety:
- File a police report with your local law enforcement agency documenting that your identity was compromised in the CenterPoint breach. Keep a copy.
- Schedule an appointment at a DPS driver license office (most now operate by appointment only — book at txdpsscheduler.com).
- Bring the police report and your ID documents. DPS staff will review your case and decide whether issuing a new license number is necessary.
A replacement costs $11, and your expiration date stays the same. Fair warning: a new number is disruptive — it changes what’s on file with your insurer, your employer, and anywhere else that stores your license number. But if there’s any sign your number is being misused (accounts you didn’t open, checks you didn’t write), the hassle is worth it. For the official process, see DPS’s page on replacing a lost or stolen license.
6. Lock down your CenterPoint account itself
Don’t forget the account where all of this started. Log into your CenterPoint online account and check three things: the contact email (attackers change it so you never see alerts), the mailing address, and the autopay bank details. A changed contact email is how an account takeover survives unnoticed.
Then give that account a long, unique password you’ve never used anywhere else — and turn on multi-factor authentication on the email address your CenterPoint bill goes to, if you haven’t. Your inbox is the recovery key for almost everything else. Our walkthrough on locking down accounts after a hack covers the password and MFA basics if you need a refresher.
7. Pull your free credit reports — weekly for now
You’re entitled to a free credit report from each bureau every week at AnnualCreditReport.com (the only FTC-authorized site — imitators with similar names exist to sell you things). Since 2023, the bureaus have permanently offered free weekly online access, so make this a habit for at least the next few months. Scan for accounts you didn’t open, hard inquiries from lenders you never applied to, and addresses where you’ve never lived. Identity theft doesn’t always happen immediately after a breach — criminals often hold stolen data for months before using it — so one check isn’t enough. Dispute anything wrong in writing with both the bureau and the company that reported it, and if it looks like identity theft, file a report at IdentityTheft.gov.
8. Turn on transaction alerts everywhere money moves
Freezes and PINs stop new-account fraud. They don’t stop someone from draining your existing accounts — especially if the breach file contained payment information or autopay bank details (the attacker’s claimed field list says it did, though the company hasn’t confirmed). Log into every bank, credit card, and investment account and turn on real-time alerts for transactions, new payees, and address changes. Most banks let you set these up in their app in under two minutes. Also review the last 90 days of statements for small test charges — thieves often run a $1 or $2 transaction first to see if a card or account number is live.
The Scams Coming Your Way: What to Watch For
The breach made this one unusually dangerous. If the attacker’s claimed field list is even half right — real names, phone numbers, account numbers, billing amounts, service addresses — the next wave of fraud against CenterPoint customers will be personal and convincing.
The utility disconnection scam. This is the big one. Expect calls, texts, and emails claiming your power will be shut off in 24 hours unless you pay immediately — and the scammer may quote your real account number, your real balance, or your real service address. That’s what makes this breach so nasty: the details that used to prove “this is really CenterPoint calling” are now in criminal hands. Real disconnections come with written notice and time to respond, never a same-day payment demand by phone. Hang up on any call about your account that you didn’t initiate, and call back using the number printed on your paper bill or typed into CenterPoint’s official site yourself. Do not pay any utility bill from a link in a text or email.
The “breach settlement” pitch. Expect fake class-action sign-up pages and “free breach assistance” calls. Real class actions (and several were filed in federal court after this breach) don’t recruit you by robocall, and no legitimate helper will ask for your full SSN or payment to “process your claim.”
Tax season is the other target. With SSN data exposed, fraudulent tax returns are the classic endgame — which is exactly why step 3 above (the IRS IP PIN) matters before tax season, not after.
Red flags that work for all of them: urgency (“act now or else”), a request for payment by gift card, wire, or crypto, and any link you didn’t ask for. When in doubt, go to the source directly — type the address yourself or use the app you already have.
What’s NOT Worth Your Money Right Now
A breach this size will bring a swarm of people trying to sell you peace of mind. Here’s what’s actually unnecessary:
- Paid identity-monitoring services. If CenterPoint offers free monitoring in its notice letter, take it — it costs you nothing. But don’t pay for monitoring out of panic. Monitoring doesn’t prevent fraud; it only tells you fraud happened. Your freeze (step 1) is what prevents it.
- Paid “credit locks.” The bureaus will happily sell you monthly lock subscriptions. The free freeze does the same job better — the lock is a product, the freeze is a federal right.
- “Breach removal” or data-deletion services. Nobody can pull your SSN and DL number back out of criminals’ hands. Once exposed, the data is exposed; the winning move is blocking how it gets used (freezes, PINs, alerts), not paying someone who claims they can erase it.
Your best spending in this situation is zero dollars and about an hour of your time.
Your Legal Footing in Texas
You have more options than most breach victims realize, and the paperwork you do now doubles as evidence later:
- Complain to the Texas Attorney General. Texas law required CenterPoint to report this breach to the AG and notify affected people without unreasonable delay. The AG’s consumer protection division takes complaints from Texans who believe notification was too slow or incomplete.
- File with the FTC at IdentityTheft.gov. If you see any misuse of your data, the FTC’s Identity Theft Report generates an official Identity Theft Report and a personalized recovery plan — and it’s the document law enforcement and the IRS recognize.
- Report to the FBI’s IC3 (ic3.gov) if you receive targeted scam attempts, especially the disconnection scam. Fraud reports build the pattern investigators need.
- Class actions are already moving. Lawsuits were filed in federal court within days of the September disclosure, and firms like Cole & Van Note are actively investigating claims on behalf of affected individuals. You don’t need to join anything today — but keep every record: the notice letter if you get one, dates you froze your credit, any fraudulent charges or accounts, and receipts for any losses. If a settlement happens, documented victims with paper trails are the ones who get paid.
Quick honesty note: I’m not a lawyer or financial advisor, and none of this is professional advice — it’s the standard federal-guidance playbook for a breach involving SSNs and driver’s licenses. If your situation involves actual fraud, talk to a consumer-protection attorney in Texas; many take breach cases on contingency.
Frequently Asked Questions
Am I affected if I’m not a CenterPoint customer?
Probably not from this breach — the confirmed data is customer information. But there are edge cases: if you lived with a CenterPoint account holder, had service in your name in the past, or applied for service, your data could be in their systems. The notification letters (if you receive one) will tell you whether your specific information was involved. And if the attacker’s larger claim is true, the field list could include people connected to accounts rather than just account holders. When in doubt, pull your free credit reports and watch — the steps above cost nothing.
I got a letter vs. I didn’t — is the advice different?
Not really. A letter tells you exactly which of your fields were exposed, which is useful for deciding whether the DPS license-number step applies to you. But no letter could mean you’re not affected, notices are still going out in batches, or the notification process hasn’t reached you yet. Either way, the checklist above is the same. The freeze is free whether or not you’re confirmed affected, so there’s no downside to doing it.
Does a credit freeze hurt my credit score?
No. A freeze only blocks new lenders from pulling your file; it doesn’t change anything in it, and it isn’t reported as a negative item. It also doesn’t stop you from checking your own reports. The one adjustment: when you apply for credit, a mortgage, or sometimes even a new phone plan, you’ll need to temporarily lift the freeze for the bureau the lender uses — online lifts process within about an hour. Federal law requires bureaus to honor lift requests quickly.
How is this different from the 7.49 million claim?
The 7.49 million number is the attacker’s own claim about what they took — it was posted on a cybercrime forum and reported by BleepingComputer and others, but CenterPoint has never confirmed it. The 1,062,060 Texas / 1,611,625 total figures come from the company’s own filing with the Texas Attorney General, which is the only officially confirmed count. Also note the field lists differ: the AG filing names driver’s license numbers and SSN information; the attacker’s claimed list includes account numbers, billing amounts, and only the last four of SSNs. Plan for the worst of both.
Should I pay for identity theft monitoring?
No — at least not out of your own pocket for this breach. If CenterPoint offers it free in its notice letter, accept it; free monitoring layered on top of a freeze costs you nothing. But monitoring alone is a smoke detector, not a lock. The freeze, the IRS IP PIN, and the fraud alert are the lock. Don’t let a monitoring subscription make you feel protected while your credit file stays open.
How long should I keep all this protection in place?
The freezes and the IRS IP PIN can stay in place permanently — they cost nothing and the inconvenience is minimal (a quick lift when you apply for credit; a new PIN each January). Keep checking your credit reports weekly for at least six months, then monthly for the first year. Stolen identity data doesn’t expire, and criminals routinely wait months before using it, so a breach like this calls for a long memory, not a quick fix.