CenterPoint Energy Data Breach: 1 Million Texans' SSNs Exposed — Detection and Response Playbook for Defenders

CenterPoint Energy, the Houston-based utility serving millions of customers across Texas and several other states, has disclosed a data breach impacting approximately 1 million Texans. According to the reporting, the compromised data includes the worst-case combination for identity theft: full names, physical addresses, Social Security numbers, and driver's license numbers.

Let me be direct about why this matters beyond the headline number. This is not a credential-stuffing spill or a leaked email list. SSN + driver's license + address is the complete identity-theft starter kit — sufficient to open credit lines, pass most knowledge-based verification, file fraudulent tax returns, and bypass identity proofing at financial institutions and government agencies. There is no password reset for a Social Security number. The exposure window for the affected individuals is measured in years, not weeks.

For defenders, the second-order concern is just as serious: utilities hold precisely this class of data at massive scale, and the energy sector remains a priority target for both financially motivated criminal groups and nation-state actors conducting pre-positioning and espionage. If you operate in energy, critical infrastructure, or any vertical holding bulk PII, this breach is your tabletop scenario made real.

At the time of writing, CenterPoint has not publicly disclosed the initial access vector, the dwell time, or the specific systems compromised. That absence of detail is itself instructive — and it means our defensive guidance must focus on the behaviors that are common to virtually every bulk PII theft operation, regardless of how the intruder got in.

Technical Analysis: How Bulk PII Theft Actually Unfolds

Because no CVE or specific exploited vulnerability has been tied to this incident, we will not speculate on the intrusion vector. What we can do — and what is genuinely useful — is dissect the attack chain that characterizes these breaches, because the post-compromise behavior is highly consistent across incidents our team has worked.

The Data Theft Kill Chain

1. Initial access — typically phishing, exposed remote access services, compromised third-party/vendor credentials, or exploitation of an internet-facing application. In utility environments, legacy customer information systems (CIS) and billing platforms are frequently reachable from flatter network segments than they should be.
2. Discovery — the attacker enumerates databases, file shares, and SaaS-connected storage. Look for queries against database schemas, unusual LDAP lookups, and access to systems the compromised account has never touched before.
3. Collection — bulk queries against customer databases, export of tables to CSV/flat files, or copying of backup files. This stage generates the most reliable telemetry: query volume, row counts, and data movement that deviate sharply from baseline.
4. Staging — data is aggregated and compressed (often with rar, 7z, or tar) into a working directory, frequently under C:\ProgramData, C:\Users\Public, or /tmp on Linux systems.
5. Exfiltration — outbound transfer via HTTPS to attacker-controlled cloud storage (Mega, Dropbox, Rclone-configured endpoints), direct transfer over non-standard ports, or abuse of legitimate sync tools. Sustained multi-gigabyte outbound transfers from database servers or workstations that have no business moving that volume are the signal.
6. Extortion/notification — increasingly, victims learn of the breach from the attacker's leak site or a regulatory notification requirement, not from their own detection stack. Texas law requires notification when breaches affect 250 or more residents, which is likely the mechanism that brought this incident to light.

Why Utilities Are High-Value PII Targets

Critical infrastructure operators often invest heavily in OT/ICS security — appropriately — while customer-facing IT estates (billing, CIS, web portals) accumulate technical debt. The result: organizations with nation-grade OT monitoring sometimes have database servers with no query auditing, service accounts with domain-wide read access, and egress filtering that permits arbitrary HTTPS to consumer cloud storage. Attackers don't need to touch a single PLC to walk away with a million identities.

Detection & Response

The detections below target the post-compromise behaviors that are generic to bulk data theft — staging, compression, and exfiltration — because those are the stages where you still have time to act. These are tuned for low false-positive rates; baseline them against backup jobs, ETL processes, and legitimate reporting workloads before deploying at high severity.

Sigma Rules

---
title: Bulk Archive Creation in Staging Directories
description: Detects compression tools (rar, 7z, tar via common wrappers) creating archives in directories commonly used for data staging prior to exfiltration. Consistent with collection/staging phase of bulk PII theft.
id: 9c2f7a41-3b68-4e19-b5d2-7f0e1a4c8d93
status: experimental
references:
  - https://attack.mitre.org/techniques/T1560/001/
  - https://attack.mitre.org/techniques/T1074/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1560.001
  - attack.t1074.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\7zg.exe'
      - '\winrar.exe'
  selection_path:
    CommandLine|contains:
      - '\ProgramData\'
      - '\Users\Public\'
      - '\Windows\Temp\'
      - 'AppData\Local\Temp\'
  condition: selection_tool and selection_path
falsepositives:
  - Software packaging and deployment tooling
  - Endpoint backup agents writing temp archives
level: high
---
title: Rclone or Cloud Sync Tool Execution from Server Systems
description: Detects execution of rclone or similar command-line cloud sync utilities frequently abused for bulk data exfiltration to attacker-controlled storage. Rare on servers outside sanctioned backup workflows.
id: 4d8e2b17-6a90-4c35-9f81-2e7b5d3a9c60
status: experimental
references:
  - https://attack.mitre.org/techniques/T1567/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rclone.exe'
      - '\megacmd.exe'
      - '\rclone.exe.exe'
  selection_cli:
    CommandLine|contains:
      - ' copy '
      - ' sync '
      - ' move '
  condition: selection_img and selection_cli
falsepositives:
  - Sanctioned cloud backup pipelines using rclone
level: high
---
title: Database Server Initiating Rare Outbound Network Connections
description: Detects common database engine processes establishing outbound connections to non-internal destinations. Database servers serving application tiers rarely initiate direct internet egress; such behavior is a strong exfiltration indicator.
id: 71b3c9e4-5d28-4f06-a392-8e1c6d0b4f27
status: experimental
references:
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\sqlservr.exe'
      - '\oracle.exe'
      - '\postgres.exe'
      - '\mysqld.exe'
      - '\mongod.exe'
    Initiated: 'true'
  filter_internal:
    DestinationIp|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.20.'
      - '172.21.'
      - '172.22.'
      - '172.23.'
      - '172.24.'
      - '172.25.'
      - '172.26.'
      - '172.27.'
      - '172.28.'
      - '172.29.'
      - '172.30.'
      - '172.31.'
  condition: selection and not filter_internal
falsepositives:
  - Database replication to DR sites over WAN (allowlist known DR ranges)
  - Vendor telemetry/licensing callbacks
level: high

KQL — Microsoft Sentinel / Defender

This hunt surfaces endpoints with abnormally large outbound transfer volumes — the exfiltration signature — correlated against the process responsible. Run it over 7 days and allowlist sanctioned backup/ETL infrastructure before treating hits as incidents.

// Hunt: Anomalous outbound data volume by device and process (potential exfiltration)
let TimeWindow = 7d;
let VolumeThresholdMB = 2000; // Tune to environment baseline
DeviceNetworkEvents
| where TimeGenerated > ago(TimeWindow)
| where ActionType == "ConnectionSuccess"
| where RemoteIPType == "Public"
| summarize TotalBytesOut = sum(BytesSent), ConnectionCount = count(),
            Destinations = dcount(RemoteIP), SampleDest = make_set(RemoteUrl, 10)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName
| extend TotalMBOut = round(TotalBytesOut / 1048576.0, 1)
| where TotalMBOut > VolumeThresholdMB
| order by TotalMBOut desc;
// Secondary hunt: Syslog-ingested Linux/network hosts with large egress to rare destinations
CommonSecurityLog
| where TimeGenerated > ago(TimeWindow)
| where isnotempty(SentBytes) and SentBytes > 500000000
| summarize TotalSent = sum(SentBytes), Events = count()
    by SourceHostName, DestinationIP, DestinationPort, ApplicationProtocol
| extend TotalSentMB = round(TotalSent / 1048576.0, 1)
| order by TotalSentMB desc;

Velociraptor VQL — Endpoint Staging Artifact Hunt

When you suspect a host was used as a staging point, hunt for large recently created archive files in common staging locations across the fleet.

-- Hunt for large archive files staged in suspicious directories (exfil staging)
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs=[
  'C:/ProgramData/**/*.zip',
  'C:/ProgramData/**/*.rar',
  'C:/ProgramData/**/*.7z',
  'C:/Users/Public/**/*.zip',
  'C:/Users/Public/**/*.rar',
  'C:/Users/Public/**/*.7z',
  'C:/Windows/Temp/**/*.zip',
  'C:/Windows/Temp/**/*.rar',
  'C:/Windows/Temp/**/*.7z'
])
WHERE Size > 50000000
  AND Mtime > now() - 1209600
ORDER BY Size DESC

Remediation / Hardening Script

The following PowerShell enables critical data-theft telemetry on Windows systems: command-line process auditing (Event 4688 with full command lines), PowerShell script block logging, and an egress audit of outbound connections from database service processes. Deploy via GPO or your RMM; validate in a test OU first.

#Requires -RunAsAdministrator
# Enable detailed process creation auditing with command line capture
auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" /v ProcessCreationIncludeCmdLine_Enabled /t REG_DWORD /d 1 /f

# Enable PowerShell Script Block and Module Logging
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging" /v EnableModuleLogging /t REG_DWORD /d 1 /f

# Audit outbound connections (Event 5156) — enable selectively; high volume on busy servers
auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:disable

# Verify settings
auditpol /get /subcategory:"Process Creation"
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" /v ProcessCreationIncludeCmdLine_Enabled
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging"

Remediation: For Organizations Holding Bulk PII

If your organization handles customer data at the scale CenterPoint does, treat this breach as a forcing function for the following:

1. Data minimization and retention review. Ask the hard question: why does your CIS/billing platform still hold SSNs for customers from 15 years ago? Purge or tokenize PII that no longer has a business purpose. Data you don't hold can't be breached.
2. Database activity monitoring (DAM). Deploy query auditing on every system holding PII at scale. Alert on bulk SELECT statements, full-table exports, and access from service accounts outside their normal application path.
3. Egress control. Database and application servers should have explicit allowlists for outbound destinations. Deny-by-default egress to consumer cloud storage, pastebin-style services, and unsanctioned file-sharing platforms. This single control breaks most exfiltration chains.
4. Segmentation between customer IT and privileged infrastructure. The compromised account should never be able to reach both the web tier and the customer database's underlying backups.
5. DLP tuned to data class, not keywords. Alert on volume — a workstation or server moving gigabytes of structured customer records is anomalous regardless of destination.
6. Third-party and vendor access audit. Many utility breaches trace to compromised vendor credentials or managed service access. Enforce phishing-resistant MFA, JIT access, and session recording for all external parties touching customer data.
7. Tabletop the notification workflow. Texas breach notification law (Tex. Bus. & Com. Code § 521.053) mandates disclosure to affected residents and to the Attorney General when 250+ Texans are affected. Your legal, comms, and IR teams should be able to execute this under pressure without improvising.

Guidance for Affected Individuals (Include in Your Customer Communications)

If you are supporting notification efforts or advising affected Texans, the actionable steps are: place a credit freeze with all three bureaus (Equifax, Experian, TransUnion — free under federal law), place a fraud alert as a secondary layer, enroll in any credit monitoring offered, monitor IRS and state tax accounts for fraudulent filings, and treat any unsolicited contact referencing CenterPoint account details as presumptively hostile — breach-driven phishing against affected populations is a near-certainty in the coming weeks.

The Bottom Line

A million Texans now face elevated identity-theft risk for the foreseeable future, and the energy sector has another data point confirming what those of us in IR already know: the customer IT estate — not the OT network — is where most of these losses occur. The vector will be disclosed eventually, but the defensive work doesn't depend on it. Control egress, monitor data access volume, minimize retained PII, and instrument the staging behaviors that every bulk theft operation must perform. Those controls would have given CenterPoint's defenders a fighting chance — and they'll give yours one too.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub