Texas utility CenterPoint Energy has confirmed a data breach after a threat actor published customer information online and claimed to have stolen around 7.5 million records.
CenterPoint said an unsanctioned third party accessed personal information through one of its external-facing systems. The company has brought in cybersecurity experts to investigate the breach.
An attacker using the name “Lovely” claims to have obtained millions of customer records containing names, addresses, phone numbers, email addresses, account numbers, and other information.
Samples of the allegedly stolen data were posted publicly, leading CenterPoint to investigate and confirm that customer information had been compromised.
CenterPoint has not confirmed the criminal’s claim that 7.5 million records were stolen. It is still working to determine how many customers were affected and what information was exposed.
The company provides electricity and natural gas to millions of customers across several states, including Texas, Indiana, Minnesota, and Ohio.
When data leaves your control, risk increases
Jeremiah Fowler, a researcher for Black Hills Information Security, says he has seen this unfortunate scenario play out far too often over the last few years when organizations outsource technology, development, customer support, data processing, or other business functions.
Once the data is out of the company’s control, the risks of exposure increase, and the potential attack surface expands. “Even if the data is exposed through a contractor, vendor, or third-party system, they are still your customers, and they trusted your organization with their information.”
He says customer information is valuable because it can create a relationship of trust and increase the success rate of social engineering or phishing attempts. “If criminals know your account number, payment amounts, support requests, and other details that only you and the service provider should know, this creates a potentially dangerous scenario to build trust.”
Fowler says organizations may outsource services, but they are still responsible for the data protection of their customers, and it is crucial that they know where information is stored, how it is transmitted, who can access it, how long it is retained, and ensure that the systems are independently audited for vulnerabilities.
This is a breach we need to watch closely
John Strand, Black Hills Information Security’s owner, adds, “This is a breach we need to watch closely because I think it’s going to break one of two ways. Either there was a customer-facing application exposed to the internet that was compromised, or this data was sitting on a service that never should have been exposed to the internet in the first place.
He calls the second possibility particularly interesting because it’s an area he has been researching quite a bit lately. “There are an incredible number of services exposed directly to the internet that have absolutely no reason to be accessible for customer or client interactions.
“Right now, the SEC filing tells us the breach involved an external service, but that still leaves the big question unanswered. Was this an application that legitimately needed to be internet-facing and was compromised, or was sensitive data sitting somewhere that never should have been exposed at all? That distinction matters, and we’ll need more information about the breach before we know which one happened.”
Information Security Buzz News Editor
Kirsten Doyle has been in the technology journalism and editing space for nearly 24 years, during which time she has developed a great love for all aspects of technology, as well as words themselves. Her experience spans B2B tech, with a lot of focus on cybersecurity, cloud, enterprise, digital transformation, and data centre. Her specialties are in news, thought leadership, features, white papers, and PR writing, and she is an experienced editor for both print and online publications.
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.