Business Context and Reporting Period
Company: CenterPoint Energy, Inc. (and subsidiaries CenterPoint Energy Houston Electric, LLC and CenterPoint Energy Resources Corp.)
Filing Type: Form 8-K (Current Report)
Date of Report: September 14, 2026
Event: Disclosure of a cybersecurity incident involving unauthorized access to customer information.
Key Financial Metrics
This filing does not contain standard financial performance metrics such as revenue, profit, cash flow, margins, debt, or liquidity figures. The document focuses exclusively on a specific operational event.
Material Changes and Incident Details
- Incident Description: In September 2026, the Company became aware of an online post claiming possession of a data set containing customer information. An investigation confirmed an unauthorized third party obtained personal information relating to a portion of customers via an external-facing system.
- Operational Impact: The delivery of electric and gas services has not been impacted and remains operational and undisrupted.
- Financial Impact: As of the filing date, the Company does not believe it is reasonably likely that there will be a material impact on its financial condition or results of operations.
- Response Actions: The Company activated cybersecurity incident response protocols, engaged third-party cybersecurity experts, reported the matter to law enforcement, and notified certain regulatory authorities.
Guidance, Outlook, and Risks
- Expenses: The Company has incurred and expects to continue incurring expenses related to the Incident and its response.
- Insurance: The Company maintains customary cybersecurity insurance coverage and believes this will offset related costs.
- Customer Notification: The Company is working to determine the full scope of affected customers and intends to notify them and regulatory authorities as required by law.
- Forward-Looking Risks: Actual results may differ based on the timing and nature of remediation expenses, the availability of insurance proceeds, regulatory compliance obligations, and the potential for the Incident's scope to be greater than initially expected.
Investor Verification Checklist
- Verify the final scope of the data breach and the number of customers affected once the investigation concludes.
- Monitor future filings for specific quantification of remediation expenses and insurance claim recoveries.
- Review regulatory communications for any mandated fines or compliance requirements arising from the Incident.
- Assess potential reputational impact on customer retention and future regulatory scrutiny.