CenterPoint Energy Data Breach Exposes 7.5 Million Customer Records via Unprotected API
What Happened — An external API used by CenterPoint Energy lacked authentication, rate‑limiting, a web‑application firewall and other basic controls. A hacker was able to pull 7.49 million customer records (names, addresses, phone numbers, account numbers, driver’s‑license numbers and the last four digits of SSNs) in JSONL format before a CAPTCHA stopped the download.
Why It Matters for Trust & Control Assurance
- This incident illustrates the exact scenario a continuous control‑assurance program is built to prevent: undocumented external interfaces that bypass authentication and logging.
- Demonstrating that you have enforceable access‑control policies, automated API inventory, and evidence of WAF/ rate‑limit enforcement satisfies a core control objective across NIST CSF, ISO 27001 and other frameworks.
- Verisq’s Access Controls capability provides continuous monitoring and audit‑ready evidence that every external endpoint is protected, logged and reviewed.
Who Is Affected – U.S. electric and natural‑gas utilities, their customers, and any downstream service providers that rely on the same API platform.
Recommended Actions
- Inventory all public‑facing APIs and verify that each enforces strong authentication, token validation and least‑privilege authorization.
- Deploy a web‑application firewall, rate‑limiting and CAPTCHA where appropriate; enable comprehensive logging and integrate logs into a SIEM for continuous monitoring.
- Conduct a gap analysis against the “Access Control – External Interfaces” control objective and collect evidence for audit readiness.
Technical Notes – The breach was enabled by a misconfigured API (no auth, no WAF, no rate limiting). No specific CVE was cited; the vulnerability is a configuration gap. Exfiltrated data included PII such as driver’s‑license numbers and partial SSNs. Source: Help Net Security