On a warm October afternoon in Houston, the kind of day when air conditioners still hum across the Gulf Coast, a dry legal notice landed with unusual force. The office of Texas Attorney General Ken Paxton reported that a CenterPoint data breach had exposed personal information belonging to more than one million customers in the state. The notice, dated October 14, 2026, did not read like a routine corporate update. It described a compromise large enough to touch households from the ship channel to the pine woods north of the city, and it raised a simple question many residents will now have to answer for themselves: what does a power company know about you, and who else might know it too?
What the attorney general office reported
According to the account released by the attorney general office and described in the Houston Chronicle, the CenterPoint data breach reached personal information tied to more than one million Texas customers. That figure alone places the incident among the larger customer notices utilities in the state have had to explain in recent years. A million is not an abstract statistic in a metro area built around electricity. It is a grid of kitchens, small shops, apartments, and rural meters, each attached to a name, an address, and a billing history.
The report does not, on the public description available so far, walk readers through the technical path of the intrusion. That absence matters. Residents are being asked to absorb a consequence without a full public map of the cause. For a journalist covering the notice, the responsible move is to stay with what officials have actually said: a large set of customer records was compromised, the attorney general office put the number above one million Texans, and the date attached to that accounting is October 14, 2026.
Scale changes the civic meaning of a notice. A breach of a few thousand accounts can be handled as a customer service problem. A breach measured in seven figures becomes a question about how an essential service stores the ordinary facts of daily life, and about how quickly those facts can leave the building.
Who sits inside that million
CenterPoint serves a wide slice of the Houston region and beyond, which means the people inside the reported total are not a single type of customer. They include renters who pay a bill in someone else name, homeowners who have lived on the same street for decades, small business owners whose shop meter is also their public identity, and families who moved after a storm and never updated every form. A utility file is often a quiet biography. It can show where you live, how long you have lived there, and whether you struggled to keep the lights on.
That last point deserves care. Energy assistance, payment plans, and medical priority designations are not gossip. They are records created so that people who depend on electricity for oxygen machines, refrigerators, or summer cooling are not treated as ordinary delinquencies. If any of those sensitive markers traveled with the compromised files, the harm is not limited to a stolen address. The public notice summarized in the Chronicle account does not itemize every field. Until the company publishes a clear inventory, customers should assume the exposure could include the kinds of details a utility must keep in order to bill and to serve.
Geography matters as well. Houston is a city of newcomers and of people who have rebuilt more than once. A current service address and an old service address together can sketch a move. For someone leaving a difficult household, that sketch is not trivial. Data breaches are often discussed as credit problems. They are also privacy problems, and privacy problems fall hardest on people who already have reasons to keep their location quiet.
What a utility file usually contains
I have spent enough time reading breach notices to know that companies prefer vague nouns. Personal information can mean a name and an email, or it can mean a Social Security number, a bank draft, and a date of birth. The difference is the difference between a nuisance and a lasting risk. Readers should look for a field by field description from CenterPoint, not a slogan about taking privacy seriously.
Even the milder version is not mild. A name paired with a service address, a phone number, and an account number is enough for a convincing impostor. Fraudsters do not need a movie plot. They need a detail a real customer would recognize. Your meter location, your last payment window, the name of the person on the account: those are the small keys that open a phone call.
Bank account numbers used for automatic draft are a separate worry. If those numbers were included, customers may need to talk with their banks about stopping drafts and issuing new account numbers, a hassle that falls on the customer even when the failure sat with the company. Social Security numbers, if present, raise the longer threat of new credit accounts opened in a stranger name. The attorney general notice, as publicly characterized, establishes the size of the population. It does not yet settle the contents. That gap is itself news.
Why the Paxton office notice matters
Texas requires many organizations to notify the attorney general when a breach crosses certain thresholds. The office of Ken Paxton functions, in these cases, as a public ledger. A posting there does not by itself prove negligence, and it does not by itself prove that criminals have already used the files. It does put the event on a record that reporters, legislators, and customers can cite without waiting for a corporate blog post to ripen into candor.
The October 14, 2026 dating of the report gives the story a clock. Notices often arrive weeks or months after a company believes it has understood the incident. That lag is sometimes justified by investigation. It is also the period in which affected people are unprotected because they have not been told. Readers should ask two dates, not one: when the company learned of the compromise, and when customers were told. The distance between those dates is where accountability lives.
An attorney general listing is not a lawsuit, and it is not a conviction. Treating it as either would be unfair to the company and misleading to readers. Treating it as optional reading would be unfair to the million people whose names sit inside the count. The Chronicle report is the public entry point. The next documents should be the customer letter and any filing that lists data elements with precision.
How CenterPoint fits into daily life
Electricity is not a lifestyle brand. It is the condition for the rest of the house. When the company that delivers it loses control of customer records, the injury is tangled up with dependence. You can leave a retailer. You cannot easily leave the utility that serves your block. That lack of exit changes the ethics of data care. A firm you cannot quit owes a higher standard of custody, not a lower one, because the relationship was never fully voluntary.
Houston readers know what it means when the grid fails in a physical sense. Winter storms and summer peaks have made reliability a political subject. A data failure is quieter. No tree is on a line. No neighborhood goes dark at once. The lights stay on while the paperwork walks out. That quiet is why these stories get less attention than outages, and why they deserve more than a paragraph at the bottom of a business page.
The company will almost certainly say that it takes security seriously and that it is offering some form of monitoring or support. Those sentences are now standard. They are not worthless, but they are not the story. The story is whether the offer matches the data that left, whether the letter is written in plain language, and whether people without reliable internet or fluent English can actually use the help.
What customers can do without waiting
Protective steps do not require a full technical autopsy. Anyone who believes they may be in the affected group can start with habits that limit damage even if the letter has not arrived. Read statements from the utility and from your bank with a slower eye than usual. A small draft you do not recognize is easier to stop in the first week than in the third month. Call numbers printed on your own bill or on the company official site, not numbers that arrive in a text claiming to be urgent help.
Impostors love a real breach. They use the headline as bait. A message that asks you to confirm a Social Security number, a password, or a one time code is not a rescue. It is often the second crime, dressed as the remedy for the first. CenterPoint, the attorney general office, and reputable news outlets will not need your password to tell you that you were affected.
If the eventual letter says government identifiers or financial account numbers were involved, a credit freeze at the major bureaus is a blunt and effective tool. A freeze makes it harder for someone else to open new credit in your name. It is free under federal law, and you can lift it when you need to apply for a loan or a card. A fraud alert is a lighter step. Neither tool erases data already copied. Both shrink what a stranger can do next. For tax related identity theft, the Internal Revenue Service publishes its own guidance on identity protection pins. Those are public consumer steps, not a substitute for a clear company notice.
The particular risk of sounding official
Utility customers are trained to obey urgent messages. A disconnection warning is not junk mail. That training is exactly what a scammer wants after a breach. If someone calls and cites your account number, your address, and a recent storm fee, the voice will feel legitimate because some of the facts are legitimate. The test is not whether the caller knows you. The test is whether you initiated the contact through a channel you already trust.
Older residents, who make up a large share of any newspaper audience in this state, are often targeted because they answer the phone and because they have longer credit histories. Adult children can help without taking over. Sit with a parent while they set a freeze. Read the letter aloud. Write down the case number if one is offered. Do not email copies of a driver license to a stranger who says the attorney general requires it. No honest office works that way.
Landlords and adult children who pay bills for relatives should check whether their own information sits on an account they do not live under. A breach follows the name on the file, not the person who flips the switch. Roommates who shared a login for convenience may now share an exposure they never discussed.
What remains unknown
Good reporting leaves a visible list of unanswered questions. Here is mine. Which categories of data were copied, viewed, or only potentially exposed? When did CenterPoint first detect the problem, and when did it conclude that customer notice was required? Were vendor systems involved, or only systems the company runs itself? Has any fraud been confirmed, or is the notice precautionary? What monitoring, if any, is being paid for, for how long, and does it cover people who lack a computer?
Those questions are not hostile. They are the minimum a million people need in order to act. A company can answer them without publishing a manual for criminals. Security researchers and regulators can examine causes in closed settings. The public needs impacts, timelines, and data elements. Confusing those two audiences is how notices become either alarmist or empty.
Lawmakers may eventually ask whether utility privacy rules match the sensitivity of the files. That is a policy debate, and it should wait for facts. What should not wait is plain language for customers who are already inside the count.
Trust after the lights stay on
The CenterPoint data breach, as reported through the attorney general office on October 14, 2026, will be remembered less for the adjective in the headline than for the follow through. Did the letters arrive in time to matter? Did they name the data? Did customer service lines answer? Did the company resist the temptation to bury the notice under storm recovery updates and rate explanations?
Essential services trade on a quiet promise: we will be there, and we will not be careless with the life you hand us in exchange. A physical outage breaks that promise in public. A records failure breaks it in private, one credit file and one anxious phone call at a time. Houston has learned to ask hard questions about poles, plants, and preparedness. It should ask the same hard questions about databases.
Until a fuller inventory arrives, the prudent reader will treat the Chronicle account and the Paxton office report as a warning with a number attached, not as a finished explanation. More than one million Texans have been told, in effect, that a stranger may now know them the way their power company knows them. That is not a spiritual crisis, and it is not a technical curiosity. It is a civic one. The measure of the response will be whether those people are given enough truth, soon enough, to protect themselves.