CenterPoint Energy Confirms Data Breach Exposing 7.49 M Customer Records via Unprotected API
What Happened — CenterPoint Energy disclosed that an unauthorized actor accessed an external‑facing API and extracted personal and billing data for roughly 7.49 million customers. The breach was first noticed when the attacker advertised the data set on a dark‑web forum, prompting the utility to file an SEC Form 8‑K and lock down the affected systems.
Why It Matters for Trust & Control Assurance
- The incident illustrates a classic control‑gap: lack of authentication, rate‑limiting, and Web‑Application‑Firewall (WAF) protection on a public API – a scenario continuous control‑assurance programs are built to detect and evidence.
- Demonstrating that you have documented, continuously‑monitored controls for external interfaces provides a defensible audit trail and satisfies multiple framework requirements (e.g., NIST CSF 2.0 “Protect – Data Security”).
- Leveraging Verisq’s Control Mapping capability lets you map this gap to the relevant control objective, collect real‑time evidence, and prove remediation to auditors and regulators.
Who Is Affected – Utilities and other energy‑sector firms that expose customer‑facing APIs; any organization handling large volumes of personally identifiable information (PII).
Recommended Actions
- Inventory all external‑facing APIs and verify that each enforces strong authentication (e.g., JWT, OAuth) and rate‑limiting.
- Deploy a WAF or similar protective service and enable logging for all API requests.
- Map the API‑security controls to your audit framework, capture continuous evidence, and update your Trust Center profile.
Technical Notes – The attacker exploited an API lacking WAF protection, rate limiting, and JWT/auth token enforcement. No specific CVE was cited; the weakness is a configuration/architecture gap. Stolen data included names, phone numbers, service addresses, account numbers, billing amounts, payment status, and partial Social Security numbers. Source: Security Affairs