CenterPoint Energy Inc. Discloses Customer Data Incident

What Happened

• On September 2026 (Form 8‑K filed September 14, 2026), CenterPoint Energy, Inc. announced an unauthorized third party obtained personal information for a portion of its customers from one of the company's external‑facing systems.
• The company activated its cybersecurity incident response protocols, engaged third‑party cybersecurity experts, reported the matter to law enforcement, and notified certain regulatory authorities. It says electric and gas service delivery has not been impacted and remains operational.

Key Details

• Filing: Current Report on Form 8‑K, Item 8.01, filed September 14, 2026.
• Scope: Company determined customer personal information was obtained by an unauthorized third party; investigation to determine full scope is ongoing.
• Impact & costs: CenterPoint does not believe a material financial impact is reasonably likely as of the filing date but has incurred, and expects to incur, response expenses. The company maintains customary cybersecurity insurance and expects insurance will offset related costs.
• Notifications: Company intends to notify affected customers and regulatory authorities as required by law and has reported the matter to law enforcement.

Why It Matters

• For investors, the immediate operational risk appears limited: utility delivery services are uninterrupted.
• Financial exposure is uncertain but could include remediation, customer notifications, regulatory compliance costs, and potential legal or regulatory actions; CenterPoint currently expects insurance to offset related costs.
• The key remaining risk is uncertainty over the final scope of affected customers and data — if the scope is larger than currently known, remediation costs and regulatory consequences could increase. Investors should watch for updates from the company, subsequent filings, and any disclosures about the investigation’s findings or insurance recoveries.