teiss – News – CenterPoint Energy faces class actions over alleged customer data breach
ao link
Houston-based utility CenterPoint Energy is facing five proposed class action lawsuits in federal court alleging that a data breach exposed the personal information of millions of customers, following a Sept. 1 claim by a threat actor that it had leaked a database tied to the company.
Three of the lawsuits were filed last week by Florida law firm Shamis and Gentile on behalf of customers Laurie Eirwin, Latoya Wyche and Christa Floyd. Two more were filed by Dallas law firm Lippe and Associates on behalf of customers Joyce Curry and Nathaniel Sonia. The lawsuits identify the customers as residents of Indiana, Texas and Minnesota.
All five lawsuits are proposed class actions, and no class has yet been certified in any of them. The lawsuits state that CenterPoint has not yet verified that the breach occurred and place the date of the incident between Aug. 17 and Sept. 1. Sonia’s lawsuit claims 7 million filtered records related to CenterPoint customers were leaked, while Wyche’s lawsuit claims approximately 6.7 million customers were affected. CenterPoint did not respond to requests for comment.
The lawsuits allege that cybercriminals gained access to customers’ protected information, including names, phone numbers, addresses, billing information and Social Security numbers. They argue CenterPoint could have prevented the breach through adequate security measures and, by allegedly failing to do so, violated industry standards and guidance published by the Federal Trade Commission for protecting consumer data. Wyche’s lawsuit alleges the company had the resources to prevent the breach but did not adequately invest in security despite its obligation to safeguard such information.
The three lawsuits filed by Shamis and Gentile focus on CenterPoint’s online account system, specifically its guest bill pay feature, as the point cybercriminals allegedly used to gain access. Those lawsuits state the feature lets customers pay bills using only an account number, but allege it also retrieves a range of personal information once the correct number is entered.
The lawsuits argue affected customers face a heightened risk of identity theft and are entitled to damages for potential costs, including identity theft insurance and monitoring, recovering from fraud, credit freezes, and emotional distress.
The lawsuits follow a Sept. 1 post on the open web by a threat actor using the handle “4d722e4d656f77,” who claimed to have leaked a CenterPoint database containing approximately 7.49 million raw records in JSON format and about 6.73 million filtered records in CSV format. A dark web intelligence summary tied to the posting listed the exposed information as including customer names, phone numbers, service and billing addresses, account information, premise IDs, billing amounts, payment status, service details, autopay and paperless billing status, and partial Social Security numbers. The threat actor provided sample data and claimed the full files were available for download.
CenterPoint Energy delivers electricity and natural gas to approximately seven million metered customers across states including Indiana, Minnesota, Ohio and Texas. As of Sept. 8, the full scope of the company’s response to the alleged breach remained unclear, and no state attorney general filings or federal agency disclosures related to the incident had been publicly made.
Please take 30 seconds to register
Already have an account? Sign in
