CenterPoint confirms customer data was stolen; a hacker claims 7.49 million records. The utility's comment: "Our filing speaks for itself."

Your electric company knows where you sleep, and now somebody else might too. Houston-based CenterPoint Energy disclosed in a Sept. 14 SEC filing that an unauthorized third party obtained personal information belonging to some customers through one of its external-facing systems, Fox News' CyberGuy Report says. A hacker told BleepingComputer they took 7.49 million customer records, including names, phone numbers, addresses, account numbers, billing amounts and partial Social Security numbers. CenterPoint has confirmed the theft but not that figure, and 7.49 million records doesn't necessarily mean 7.49 million people. The hacker claims they got in by cycling through millions of IDs on a public CenterPoint API with no effective rate limiting. That's the attacker's story, not a confirmed finding. Asked for details, CenterPoint said, "Our filing speaks for itself." Power and gas kept flowing normally. Think of an API as a utility's loading dock. If the hacker is right, nobody put a gate on it. Watch for an official breach notice, ignore texts claiming to be from the utility, and consider a free credit freeze. Your data is only as safe as the least-guarded door.