CenterPoint Energy says an unauthorized third party obtained personal information from part of its customer base through an external-facing system, and the investigation remains underway. Electric and gas delivery continues without disruption, while the company says it does not currently expect a material financial impact and believes Cybersecurity insurance will offset related costs.

Key Highlights

  • CenterPoint Energy activated cybersecurity response procedures and brought in outside experts to investigate the incident.
  • Electric and gas delivery remains operational and undisrupted.
  • An unauthorized third party obtained personal information tied to some CenterPoint Energy customers through an external-facing system.
  • CenterPoint Energy activated its cybersecurity response, engaged third-party specialists, and notified law enforcement and certain regulators.

CenterPoint Energy, Inc. (NYSE: CNP) says an unauthorized third party obtained personal information tied to some customers through an external-facing system. The investigation is continuing, while electric and gas delivery remains operational and undisrupted.

Cybersecurity Response Underway

CenterPoint Energy activated its cybersecurity incident response protocols after learning of an online post claiming access to customer information. The company engaged third-party cybersecurity specialists to examine the incident and took steps to strengthen protections for its systems. Law enforcement authorities have been informed, and certain regulatory authorities have also received notification. The company has incurred expenses connected with the incident and expects further response-related costs.

Insurance And Financial Exposure

The company says it does not currently believe the incident is reasonably likely to cause a material effect on its financial condition or results of operations. CenterPoint Energy maintains customary cybersecurity insurance and believes that coverage will offset costs linked to the incident. The scope of affected customers and personal information is still being assessed. The company identified the possibility that the incident could prove broader than initially expected, along with uncertainties around remediation expenses, insurance proceeds and regulatory compliance obligations.