Circuit Wire — a daily news update from the Circuit.
CenterPoint Energy told the Securities and Exchange Commission this week that an unauthorized third party obtained personal information belonging to some of its customers. The disclosure followed a hacker publishing the stolen files, a set that BleepingComputer reported runs to 7.49 million records.
CenterPoint is a Houston utility that supplies electricity and natural gas to about 7 million metered customers across Indiana, Minnesota, Ohio and Texas. It employs roughly 8,300 people and reports more than $9.3 billion in annual revenue.
A threat actor using the alias "4d722e4d656f77" contacted BleepingComputer earlier this month and said the stolen records hold names, phone numbers, service and billing addresses, account numbers, billing amounts and partial Social Security numbers. The attacker said the company ignored their messages and treated them as a joke, then leaked the data.
The method was not a break-in. According to the intruder, the records came out by stepping through millions of sequential IDs on one of CenterPoint's public-facing APIs. That interface had no rate limiting and no web application firewall, so automated requests ran unchecked until the whole set was drained.
The company's SEC filing confirms the theft but names neither the attacker nor the number of customers affected, and it does not list the categories of data involved. CenterPoint said its electric and gas services were never disrupted and that it does not expect a material effect on its business or financial condition.
The utility has brought in outside cybersecurity experts, strengthened protections on its systems and reported the incident to law enforcement and regulators. Several proposed class actions have already been filed in federal court. Those complaints allege the data was taken between Aug. 17 and Sept. 1. The Register also covered the disclosure on Tuesday.
The case follows a run of large exposures traced to weakly protected interfaces rather than malware. Circuit Wire reported this month on the breach of an ID verification firm that put 153 million driver's license scans at risk.
Want a weekly roundup of the major stories shaping the security industry? The On The Circuit newsletter is read by more than 12,000 protection professionals.
Spotted something we should cover? Send tips and feedback via circuit-magazine.com.