CenterPoint Energy Data Breach Exposes 7.49 M Customer Records via Unprotected Public API
What Happened — An attacker iterated through millions of customer IDs on CenterPoint Energy’s public API, which lacked rate‑limiting, a web‑application firewall, and other automated‑access protections. The activity resulted in the theft of personal data for an estimated 7.49 million customers, including names, addresses, account numbers and partial SSNs.
Why It Matters for Trust & Control Assurance
- The incident illustrates a classic control‑gap: external‑facing APIs not protected by proper access‑control and abuse‑prevention mechanisms, a scenario continuous control‑assurance programs are built to detect and remediate.
- Demonstrating that you have documented, monitored, and regularly tested API security controls provides defensible evidence for audits and regulator inquiries.
- Verisq’s Control Mapping capability can automatically align your API‑security controls to the VCF control objective “Application security – enforce authentication, authorization, and rate‑limiting for external interfaces,” delivering continuous evidence across frameworks.
Who Is Affected – U.S. utility sector (electric and natural gas providers); any organization exposing customer‑facing APIs without adequate abuse‑prevention controls.
Recommended Actions
- Inventory all external‑facing APIs and verify that rate‑limiting, WAF, and authentication are enforced.
- Map the API‑security controls to the VCF control objective for application security and capture evidence in a continuous monitoring platform.
- Conduct a focused penetration test or automated scan of API endpoints to validate remediation.
- Update incident‑response playbooks to include API‑abuse detection and reporting.
Source: BleepingComputer
Technical Notes
- Attack vector: exploitation of a misconfigured public API (no rate limiting, no WAF).
- Data types exfiltrated: names, phone numbers, service/billing addresses, account numbers, billing amounts, partial SSNs.
- No ransomware or service disruption reported.
Source: same as above