On September 14, 2026, CenterPoint Energy filed a Form 8-K under Item 8.01. In September 2026 the company became aware of an online post by a third party claiming a data set of customer information. The company then determined that an unauthorized third party obtained personal information for a portion of customers through an external-facing system. Electric and gas delivery was not affected. As of the filing, CenterPoint did not expect a material hit to financial condition or results. It reported the matter to law enforcement, said it had notified some regulators, and said cybersecurity insurance should offset response costs.
The 8-K does not list the data fields or the number of people. It also does not name the external system.
Snapshot
| Field | Detail |
|---|---|
| Filing | Form 8-K · Item 8.01 · Sept 14, 2026 |
| What the company determined | Personal information taken through an external-facing system |
| Service | Electric and gas delivery not disrupted |
| Texas count in news reports | 1,062,060 Texans |
| Fields in those reports | Name, address, Social Security information, driver’s license number |
| Notice status in those reports | Consumers not yet notified when the AG report was posted |
Click2Houston on October 14 and KHOU on October 15 read the Texas Attorney General’s breach database as 1,062,060 Texans, with names, addresses, Social Security information, and driver’s license numbers. Both said the report showed consumers had not been notified yet, and that the count and the notice flag can change. CenterPoint’s statement to those stations said it was still identifying who must be notified. The company repeated that delivery of electric and gas service was operating.
This post does not link the online post the 8-K mentions.
What a reader can do with this
| Do | Why |
|---|---|
| Wait for a letter and check it against the bill | The AG report, as the stations read it, said notice had not gone out |
| Call the number on a CenterPoint bill | A text that already “knows” a recent payment amount is the scam the stations described |
| Freeze credit if the letter names a Social Security number | The AG field list, as reported, includes Social Security information |
| Type centerpointenergy.com | A “My Account verification” mail is not the 8-K |
The 8-K says the investigation was still open on September 14. A later letter can name a smaller or larger set of people than 1,062,060.
MFA on My Account
| Grade | Meaning |
|---|---|
| Fail | No public YubiKey or Google Authenticator path, or SMS / email codes remain the documented sign-in |
| Strong | FIDO2 / YubiKey-class security key for sign-in |
| Platform | Grade | YubiKey | Authenticator |
|---|---|---|---|
| CenterPoint My Account | Fail | No | No |
| Facebook (optional sign-in) | Strong | Yes | Yes |
CenterPoint’s account FAQ treats the user ID as the email used at registration. A password lockout hits after five failures. Some customers can add a PIN by calling the number on the bill. The same help offers Sign in with Facebook. It does not name YubiKey or Google Authenticator. The native account is Fail. Facebook’s own login is a separate account and is already Strong. A key on that Facebook account does not replace a letter CenterPoint has not sent, and it does not tell a customer whether their record was in the external system.
Directory: MFA support directory · Business Apps.
Recommended MFA tools
| Product | Best for | Get it |
|---|---|---|
| YubiKey 5C NFC | USB-C laptops + NFC phones | Amazon |
| YubiKey 5 NFC | USB-A desktops + NFC phones | Amazon |
| Proton Pass | Passkeys + authenticator-style TOTP | Proton Pass |
We may earn a commission if you buy a YubiKey or sign up for Proton Pass through the links above.
Independent cybersecurity audits
We audited CenterPoint, the SEC host, three Houston newsrooms, and Check Point’s research host on October 24, 2026. 100% is the ideal — none reach it. Check Point’s October 19 digest is where this filing showed up beside other items. These scores do not measure whether a meter was in the affected set.
| Organization | Domain | Overall | vs 100% |
|---|---|---|---|
| SEC | sec.gov | 88% | −12 |
| CenterPoint Energy | centerpointenergy.com | 75% | −25 |
| KHOU | khou.com | 53% | −47 |
| ABC13 | abc13.com | 46% | −54 |
| Click2Houston | click2houston.com | 45% | −55 |
| Check Point Research | research.checkpoint.com | 34% | −66 |
| Domain | Identity | Transport | Website |
|---|---|---|---|
| sec.gov | 90% | 45% | 98% |
| centerpointenergy.com | 70% | 15% | 87% |
| khou.com | 50% | 15% | 40% |
| abc13.com | 35% | 15% | 37% |
| click2houston.com | 10% | 15% | 68% |
| research.checkpoint.com | 0% | 45% | 40% |
Audit links: sec.gov · centerpointenergy.com · khou.com · abc13.com · click2houston.com · research.checkpoint.com
centerpointenergy.com is 75%, with Transport 15%. research.checkpoint.com is Identity 0%. click2houston.com is Identity 10%. Type the utility host if a mail offers an “AG notice portal.”
Website stack
Passive homepage + Certificate Transparency probes (October 24, 2026). Versions only — not a claim these homepages were the external system in the 8-K.
| Domain | Stack note |
|---|---|
| centerpointenergy.com | Next.js; Sectigo TLS expires 2027-03-14 |
| sec.gov | Drupal, version hidden; DigiCert TLS expires 2027-04-29 |
| khou.com | CMS undetected; Sectigo TLS expires 2027-04-28 |
| click2houston.com | CMS undetected; Let’s Encrypt TLS expires 2027-01-20 |
| abc13.com | CMS undetected; Amazon Trust TLS expires 2027-03-25 |
| research.checkpoint.com | CMS undetected; Let’s Encrypt TLS expires 2026-11-26 |
Blacklist and lookalikes
Email blacklist checks (public DoH, October 24, 2026): centerpointenergy.com, sec.gov, khou.com, click2houston.com, abc13.com, and research.checkpoint.com were clear on mail/domain lists we can query. centerpointenergy.com, khou.com, and abc13.com showed SPFBL on web IPs — shared-edge noise, not led.
The sec.gov scan is mostly the three-letter name sec. sec.cloud has mail and no site. That is not, by itself, an impostor of this 8-K. The Check Point host’s scan flagged checkpoint.cloud the same way. Check Point and CenterPoint are different companies.
| Lookalike | Technique | Signal |
|---|---|---|
| centerpointenergy.co | TLD swap | Mail (NS + A + MX) |
| cnenterpointenergy.com | inserted n | Mail (NS + A + MX) |
| abc13.info | TLD swap | Mail (NS + A + MX) |
click2houston.co and click2houston.net point at the station. khou.biz, khou.info, and khou.us point at KHOU. khou.org has mail and does not redirect there. Continuous monitoring: Cybersquat Domain Monitoring.
CourtListener on October 24, 2026 includes Vickers v. CenterPoint Energy, Inc., S.D. Tex. 4:26-cv-08191, filed September 23, 2026, federal question, nature of suit 890. We did not read a complaint. Other September cases against CenterPoint in the same court are coded as personal injury or contract.
Related coverage
Sources: Form 8-K, Sept 14, 2026 · Click2Houston, Oct 14, 2026 · KHOU, Oct 15, 2026 · CenterPoint account FAQ · Check Point digest, Oct 19, 2026. Independent EmailMeNow audits, website-tech, blacklist, cybersquat, and CourtListener searches October 24, 2026. Domain scores: audit.emailmenow.com only.