CenterPoint Energy's breach record shows why notification work cannot wait until every technical question is answered. The company disclosed the incident in a September 14 SEC filing without giving a final population count. By October 13, a Texas Attorney General listing recorded 1,062,060 affected Texans. Click2Houston reported the figure and noted that affected consumers had not yet been notified when the filing was submitted.
The count may change. The data scope may change. The investigation may identify additional facts about the external system. A notification workflow has to preserve those possibilities while meeting legal deadlines and communicating accurately.
External asset observations can support the investigation, but they do not identify affected people. A ZoomEye domain query returned 241 indexed matches on November 6, 2026, with 125 matching port 443 and 111 matching port 80. Those public asset counts are not notification populations or proof of compromise.
Keep four populations distinct
An incident response team should maintain separate counts for people potentially affected, people confirmed in the exposed dataset, people whose records were reviewed, and people sent a notice. Regulators, executives, and customer-service teams may ask for any of these figures, and combining them creates avoidable errors.
The Texas Attorney General filing recorded 1,062,060 affected Texans. That is a jurisdictional figure, not necessarily the total across every state or customer group. The attacker's claim of 7.49 million records is unverified and should remain labeled as an allegation.
Each population needs an owner, source, timestamp, and confidence level. A number should never move from one category to another without a documented review.
Build the data map
The notification team needs to know which fields were involved, how the records were organized, and which systems could have supplied them. The reported categories include names, addresses, Social Security information, and driver's-license numbers. The exact combination for each person may vary.
Use application and database evidence to connect the external system to the affected records. A hostname inventory is not enough. The team should identify the datasets, access paths, query logs, and retention rules that could explain the exposure.
The external query can help identify services that require review. It cannot establish that a domain match handled the affected data. Each service should be linked to an owner and a data classification before it is used in the notification analysis.
Preserve evidence for legal and technical review
Keep the original filings, source URLs, retrieval times, query expressions, and result identifiers. Preserve application logs and configuration snapshots before normal retention periods remove them. Record who collected each artifact and where it is stored.
The evidence package should make clear which statements came from the company, which came from a regulator, which came from a news report, and which came from an attacker. It should also show the collection method for external search results.
The Texas Attorney General Data Breach Reporting page explains the state's reporting process and its requirements. Legal counsel should determine the applicable notice dates and content for each jurisdiction.
Prepare customer-facing facts
Customers need clear information about what happened, what data was involved, what the company is doing, and where to get help. They do not need an unresolved technical debate about whether the attacker's API claim is accurate.
The notification should avoid saying that a specific endpoint caused the breach unless the investigation supports it. It should avoid saying that every person in a dataset was affected if the review is still in progress. It can explain the confirmed external-system access and the categories under review.
Customer-service scripts should match the legal notice. Give representatives a short list of approved facts, a route for unusual questions, and a way to record reports of suspicious activity.
Reconcile after the first notice
Notification is not a one-time send. Addresses may fail, customers may call with corrections, and regulators may request updates. The team should reconcile the notice list against the affected population and record every change.
The final incident record should show how the count evolved, what evidence supported each update, and which external observations were used only for investigation. That history matters when the company has to explain a later revision.
CenterPoint's public facts are uncomfortable but manageable when separated correctly. The confirmed external-system access and the statewide listing belong in the notification record. The unknown endpoint, the unverified attacker claim, and the 241 public asset matches belong in the evidence record with explicit limits.