A data breach at CenterPoint Energy affected more than one million Texans, according to a report filed with the Texas Attorney General's office and released Tuesday on the AG's website. The filing puts the affected count at 1,062,060 Texas customers.

CenterPoint serves nearly 2.8 million metered electric customers in the Houston area and about 1.9 million gas customers statewide, so the breach reached a large fraction of its Texas base.

The incident began in September, when CenterPoint said it was aware of an online post by a third party claiming to have obtained customer information through one of its external-facing systems.

The company confirmed the breach in an SEC filing, which did not specify the number of customers or the type of information affected.

The confirmed facts come from two channels. First, the report to the Texas Attorney General's office states the breach included names, addresses, Social Security numbers and driver's license numbers, and shows CenterPoint has not yet contacted the affected customers.

Second, CenterPoint's own statement says it activated incident response procedures upon learning of the issue and engaged external cybersecurity, forensic, and legal advisors to assist the investigation.

The company says it continues to work with third-party experts to assess the scope of affected customer data and identify which customers must be notified under applicable legal requirements.

Social Security numbers and driver's license numbers are the raw material for durable identity theft — they cannot be reset like a password, and victims face years of fraud risk.

The exposure of roughly one million Texans' core identity records arrives alongside a federal environment where the Pentagon separately confirmed a breach exposing sensitive data on nearly 3 million people, a pattern that underscores how broadly large institutions are being hit.

For customers, the practical risk is targeted phishing, tax and loan fraud, and identity theft using highly accurate personal details.

A striking detail in the AG filing is that CenterPoint had not yet contacted the 1,062,060 affected Texas customers as of the report. The company says it is still determining which customers will receive notifications in accordance with applicable legal requirements.

Meanwhile, customers have already filed class-action lawsuits against CenterPoint in multiple states over the breach last month. The company's statement notes that its delivery of electric and gas services has not been impacted and remains operational and undisrupted.

CenterPoint says its investigation is active and ongoing, with cybersecurity, forensic, and legal advisors still assessing the scope of affected data.

Customers should expect formal notification letters once the company completes its scoping work, and the pending multi-state class actions will likely grow as more details surface.

For affected Texans, the disclosure of Social Security numbers and license numbers justifies credit freezes and fraud alerts regardless of whether notification arrives.

How quickly CenterPoint notifies customers, and what remediation it offers, will shape both the legal exposure and customer trust going forward.