SecurityWeek reported that CenterPoint Energy told the Texas Attorney General's Office this week that 1,062,060 Texas residents were affected by a data breach. The Houston-based utility had told the SEC about stolen customer information a month earlier. Its filing says the data includes names, addresses, Social Security numbers and driver's license numbers.
These numbers measure different things. A hacker claimed on a crime forum to hold nearly 7.5 million user records. The company's count covers Texas only. It also serves customers in Indiana, Minnesota and Ohio, who might be affected, and the total is unclear. The company said only some customers were hit and its operations were not affected. How the intruder got in is not disclosed. SecurityWeek says no notification letters seem to have gone out yet.
The company said it learned of the breach after the hacker's public post. A Social Security number is hard to change, unlike a password, so stolen identity data stays useful to thieves. Leaders who hold such data can ask three questions. How would we spot the theft ourselves? How long do we keep identity fields? How fast could we give a count by state?