CenterPoint Energy disclosed that an unauthorized third party got into customer data through one of its external systems, after online claims by a hacker that millions of records had been stolen from the company.
CenterPoint Energy is a Houston-based public utility company that provides electricity and natural gas services. It serves about 7 million customers across Indiana, Minnesota, Ohio, and Texas.
A hacker, posting under the alias ‘4d722e4d656f77,’ claims to have pulled 7.49 million lines of CenterPoint customer data through an API that had no web application firewall, no rate limiting, no certification checks, and no authentication token.
The threat actor wrote that the data was pulled in JSONL format, then filtered into CSV files that keep the personal information intact. The post calls it “funny” that a company CenterPoint’s size had such weak protection, and notes that a CAPTCHA cut the download short at 7.49 million lines. Without it, the threat actor wrote, “we would have pulled 17.44 million data.”
The listed fields include customer names, phone numbers, service and billing addresses, account numbers, premise IDs, billing amounts, due dates, autopay and paperless billing status, rate class, email addresses, driver’s license numbers, and the last four digits of Social Security numbers.
In an SEC Form 8-K filed on September 14, CenterPoint confirmed it became aware of an online post by a third party claiming to hold a data set containing customer information.
The company added it’s continuing to work with outside experts to determine the scope of the breach, and that it “intends to notify affected customers and regulatory authorities as required by applicable law.”
“The Company’s delivery of electric and gas services has not been impacted and remains operational and undisrupted. As of the date of this filing, the Company does not believe it is reasonably likely that there will be a material impact on the Company’s financial condition or results of operations,“ reads the SEC filing.
Local media write that CenterPoint Energy is facing several class action lawsuits from customers in multiple states over an alleged data breach.
Click Here For The Original Source.
