CenterPoint Energy data breach lawsuits

CenterPoint Energy faces at least eight proposed class actions in federal court in Houston over a customer data breach that the utility disclosed in a September 14, 2026 filing with the Securities and Exchange Commission. A report filed with the Texas Attorney General and published October 12, 2026 lists 1,062,060 Texans as affected, with names, addresses, Social Security numbers and driver's license numbers exposed.

The first suit, Floyd v. CenterPoint Energy, Inc., No. 4:26-cv-07567, was filed September 9, 2026 in the U.S. District Court for the Southern District of Texas. It seeks to represent everyone whose information was compromised. CenterPoint says it is investigating and plans to notify affected customers. No court has ruled, and there is no settlement.

CenterPoint Energy, Inc. is a publicly traded utility headquartered in Houston. The Floyd complaint describes it as providing electric and natural gas service to millions of customers, primarily in Texas, Indiana, Minnesota and Ohio.

The Floyd plaintiff, Christa Floyd, is an Indiana resident and CenterPoint customer. She is represented by Shamis & Gentile, P.A., including Leanna Loginov. CourtListener lists Judge Drew B. Tipton as assigned.

CourtListener also shows later suits in the same court: Wyche, Curry and Sonia (filed September 10), Eirwin (September 11), Lindley and Mathis (September 17) and Vickers (September 23). Different judges are listed on several of them. Class Action Pulse did not find an order consolidating the cases as of October 15, 2026.

CenterPoint's 8-K filing says the company learned in September 2026 of an online post claiming to offer a CenterPoint customer data set. It says an unauthorized third party obtained personal information of "a portion" of customers through an external-facing system. The company said its services were not affected, that it did not expect a material impact on its finances, that insurance applies and that it had notified law enforcement and regulators.

On October 12, 2026, the Texas Attorney General's breach database listed 1,062,060 affected Texans, according to KPRC Click2Houston and ABC13. The listing said affected people had not yet been notified. That count covers Texas residents only; no total for Indiana, Minnesota or Ohio has been published.

A threat actor post on September 1, 2026 claimed millions more records, and the Floyd complaint says about 6.7 million customers were affected. Those figures come from the attacker's claim and the plaintiff's allegations. CenterPoint has not confirmed them, and they differ from the Texas filing.

The Floyd complaint alleges, on information and belief, that the breach happened between August 17 and September 1, 2026 through the "guest" feature of CenterPoint's MyAccount Online system, which let people pay bills without logging in. The complaint says the feature returned full customer records for an account number alone, that account numbers were predictable and sequential, that the system confirmed whether a guessed number was valid and that there were no effective rate limits. It alleges exposed data included names, contact details, account and billing data, driver's license numbers and Social Security numbers, and that the data appeared on the dark web.

In an October 14 statement to ABC13, CenterPoint said it continues to investigate with outside cybersecurity, forensic and legal advisers, is working to identify who will be notified and that services were not disrupted. The company has not publicly addressed the guest-feature allegations or responded in court.

No court has ruled. None has found CenterPoint negligent, certified a class, appointed lead counsel or decided whether the cases will be combined.

The Floyd complaint proposes a class of all persons whose private information was compromised in the data breach. It excludes CenterPoint and its affiliates, people who opt out, and the judges and their families.

In practice, the clearest sign is a breach notice letter from CenterPoint, which the company says it intends to send. Customers in all four states could fall within the wording if their data was involved. The definition is proposed and may change, especially if the cases are consolidated.

Watch your mail and email for a CenterPoint notice and keep it. Consider a credit freeze with Equifax, Experian and TransUnion, which is free, and review credit reports at annualcreditreport.com. Be cautious with calls or messages that cite your CenterPoint account number.

People with questions can contact one of the plaintiffs' firms or their own lawyer. A Class Action Pulse inquiry is only an inquiry; it does not join any lawsuit or create representation.

No money is available. The Floyd complaint asks for damages including punitive damages, restitution, lifetime credit monitoring, security improvements ordered by the court and attorneys' fees. These are requests, not awards. Any payment would come only from a judgment or a court-approved settlement.

• August 17 to September 1, 2026: alleged breach window, per the Floyd complaint.
• September 9, 2026: Floyd filed.
• September 14, 2026: CenterPoint files its 8-K.
• October 12, 2026: Texas Attorney General listing published.

There is no claim, exclusion or objection deadline. Those rights arise only after class certification or a proposed settlement.

An 8-K is a form public companies file with the SEC to report major events. Negligence per se is a claim that breaking a safety law or regulation is itself evidence of negligence. An implied contract is an agreement inferred from conduct, here the claim that customers gave data expecting it to be protected. Consolidation means a court combining related cases, often under one judge and one set of lead lawyers. A credit freeze blocks new credit accounts in your name until you lift it.

The Houston cases are likely to face motions to consolidate and to appoint interim class counsel. CenterPoint's notice letters should clarify who was affected in each state and what data was involved, and may offer credit monitoring.

A practical note: a credit freeze takes a few minutes at each bureau's website and does not affect your existing utility service or credit score.

CenterPoint's 8-K supports the discovery, the external-facing system and the company's notification plans. KPRC and ABC13 support the Texas count, data types and the company's October 14 statement. The Floyd complaint supports the alleged method, dates, 6.7 million figure, class definition, claims and relief, all of which are unproven allegations. CourtListener supports the case list. Reuters reported the 8-K disclosure.

Class Action Pulse is not a law firm or settlement administrator and does not guarantee eligibility or payment. This article is general information, not legal advice.