TEXAS UTILITY CENTERPOINT ENERGY CONFIRMS DATA BREACH AFTER HACKER CLAIMS 7.49M RECORDS STOLEN

Summary from the TLDR InfoSec newsletter

CenterPoint Energy confirmed an attacker pulled customer data through an external-facing API on September 12. A hacker using the alias "4d722e4d656f77" claims 7.49 million records, including names, phone numbers, billing addresses, account numbers, payment status, and partial Social Security numbers. The attacker says the API lacked WAF protection, rate limiting, and JWT/auth tokens, and stopped only after a CAPTCHA was added.