A close read of the company’s recent SEC filings shows it never confirms — or rules out — whether Hoosier customers already frustrated over rate hikes fell victim to data breach.
Houston HarwoodEvansville Courier & Press
Sept. 18, 2026, 4:56 p.m. CT
- CenterPoint Energy disclosed Sept. 14 that an unauthorized party accessed personal information from “a portion” of its customers.
- Asked directly whether Southwest Indiana customers are among those exposed, a company spokesman told the Courier & Press only, “Our [SEC] filing speaks for itself.”
- That filing does not say whether Indiana customers’ personal informater were — or were not — exposed under the data breach.
EVANSVILLE — Asked directly whether Southwest Indiana customers are among those whose personal information was exposed in a recent data breach, a CenterPoint Energy spokesman gave the Courier & Press a brief response: “Our filing speaks for itself.”
But a close reading of that filing – known as an 8-K – leaves several questions unanswered.
In a Sept. 14 disclosure to the U.S. Securities and Exchange Commission, CenterPoint Energy said an unauthorized third party had obtained personal information belonging to “a portion of” its customers through one of the company’s external-facing computer systems. The filing does not name Indiana, or any other state. It gives no breakdown of which customers – residential, commercial or business – might be affected.
It described the company’s investigation as “ongoing” and warned investors that the true scope of the breach could turn out to be “greater than initially expected.”
The unanswered question – whether the breach impacted Hoosier customers – lands at a time when the company has spent the past year and a half fighting sustained and increasingly organized pushback from Southwest Indiana ratepayers over rising bills, fees and what some elected officials have deemed a lack of communication.
More than a few Evansville-area customers saw their bills more than double in January, prompting a wave of public hearings, a resolution from the Evansville City Council urging state regulators to pause further rate increases, and a petition asking Indiana Gov. Mike Braun to force reconsideration of a rate hike the Indiana Utility Regulatory Commission approved in February 2025.
“Folks are paying more than their mortgages in electric bills, and it’s tough out there,” City Council President Ben Trockman said in April, when the council adopted its resolution. CenterPoint has said it remains committed to affordability, pointing to expanded financial assistance programs and a $5 million Community Energy Improvement Fund it created last year.
It’s against that backdrop that CenterPoint disclosed the data breach — and then, when asked, declined to say whether it involves the same customers already frustrated with the company.
What the filing says — and doesn’t
CenterPoint’s Sept. 14 filing was made under Item 8.01 of Form 8-K, a section of federal securities law companies use to voluntarily disclose significant events to investors. It is not the section reserved for cybersecurity incidents a company has determined to be “material,” a designation that would have triggered a stricter, four-business-day disclosure deadline. CenterPoint’s filing states the company “does not believe it is reasonably likely” the breach will have a material financial impact.
Beyond that, the filing is sparse. It confirms an unauthorized party gained access to customer’s personal information; that CenterPoint has notified law enforcement and “certain regulatory authorities” it does not name, and that the company intends to notify affected customers “as required by applicable law.”
It does not say how many customers are affected, what categories of information were exposed, or where those customers live.
Noah Stubbs, a CenterPoint Energy media relations specialist, responded to written questions from the Courier & Press on Friday — including whether Evansville and Vanderburgh County customers are among those affected — with the same line the company has given other media outlets asking similar questions: “Our filing speaks for itself,” even though the filing makes no mention of which customers are or could be affected.
What outside reports – and a lawsuit – allege
Outside CenterPoint’s own filing, there is evidence indicating the scope of the breach could be vast.
A hacker claiming responsibility for the breach posted on an online forum claiming to have obtained close to 7.5 million customer records from CenterPoint, according to a cybersecurity trade publication that reviewed the post. CenterPoint has not confirmed that figure, and the Courier & Press could not independently verify it.
Multiple news outlets have reported that a wave of federal class-action lawsuits followed.
The Courier & Press was not able to independently verify the total number of suits filed, but did identify several, including a complaint filed Sept. 10 in the U.S. District Court for the Southern District of Texas, where CenterPoint is headquartered, on behalf of a proposed nationwide class of customers whose personal information the suit alleges was compromised.
That complaint – filed four days before CenterPoint’s own SEC disclosure – alleges the breach exposed customers’ names, contact information, account numbers and Social Security numbers, among other data.
What Indiana law requires
Under Indiana law, a business that experiences a data breach affecting Indiana residents must notify the Indiana attorney general’s office, generally within 45 days of discovery.
The Courier & Press asked the attorney general’s consumer protection division whether CenterPoint had filed such a notice. The office did not immediately respond.
Houston Harwood may be contacted with questions and feedback at houston.harwood@courierpress.com
