“An unauthorized third party obtained personal information relating to a portion of the company’s customers through one of the company’s external-facing systems.”
“A portion” is doing heavy lifting next to 7.49 million files pulled from an exposed API. The utility serves about 7 million customers. Those customers can’t switch providers, and now their driver’s licenses are on a crime forum. CenterPoint confirmed the breach in an SEC filing only after the attacker bragged about it.