What the CenterPoint Breach Can Teach Small Businesses About Cyber Hygiene

Most breaches don't start with a movie-style hack. They start with the basics: a system open to the internet that nobody locked down, a missing login check, a known problem that sat on the to-do list too long. Cybersecurity hygiene 101 is still the best defense most businesses have.

That's what came to mind reading about the CenterPoint Energy breach here in Texas.

What we know

In a September filing with the SEC, CenterPoint said it learned in September that someone had posted online claiming to have its customer data. The company said an unauthorized party got customers' personal information "through one of the Company's external facing systems." It brought in outside experts, notified law enforcement and certain regulators, and said electric and gas service wasn't disrupted.

On October 15, KHOU reported that a report from the Texas Attorney General's office shows more than 1 million Texans may be affected. The information includes names, home addresses, Social Security numbers, and driver's license details. As of that report, customers hadn't been notified yet, and CenterPoint said the investigation was ongoing.

What we don't know

CenterPoint has not said what caused the breach.

The person claiming responsibility told reporters they pulled records from a public web connection (an API) that didn't require a login and didn't limit how many requests one person could make. That is the attacker's claim. CenterPoint has not confirmed it, and we're not treating it as fact.

The questions worth asking

I'm not pointing fingers. I've spent my career in cybersecurity, and I know how these things usually happen. So here are honest questions, not accusations:

• Was a fix already on the backlog? Security gaps are often known. They show up in an audit or a test, get written down, and wait their turn.
• Was the team struggling to get budget? A known risk with no money behind it is still a risk.
• Did an alert go off that nobody saw? When security tools fire hundreds of warnings a day, the important one can get buried. That's called alert fatigue, and it's common.
• Was the fix stuck in internal politics? Sometimes everyone agrees something should change, but nobody agrees on who owns it or when.

We may never get the answers for CenterPoint. But it's worth asking them about your own business.

Small businesses face the same problems, just smaller

You may not have a million customer records. You probably also don't have a security team, a big budget, or someone watching alerts all day. The same issues show up, just on a smaller scale:

• The "we'll fix it next month" item that's been on the list since last year.
• The old employee account nobody turned off.
• The vendor who still has remote access to your systems from a project two years ago.
• The backup nobody has tried to restore.

Attackers don't care what's planned for next quarter. They care what's open today. If that list sounds familiar, we can help you sort it out.

A simple cyber hygiene checklist

None of this is fancy. That's the point. Boring basics stop most attacks.

1. Know what faces the internet. Your website, email, remote access, online forms, and any app customers log into. Lock those down first.
2. Turn on multi-factor authentication (MFA). Use it for email, banking, admin accounts, and remote access at a minimum.
3. Give people only the access they need. Not everyone needs admin rights. Remove access when someone changes roles or leaves.
4. Keep software updated. Turn on automatic updates where you can, and start with anything connected to the internet.
5. Control vendor access. Know which outside companies can get into your systems. Give access only when needed, and turn it off when the job is done.
6. Back up your data, and test it. Keep at least one copy offline or separate from your main systems, and make sure you can actually restore it.
7. Keep a list of what you have. Computers, phones, accounts, cloud apps. You can't protect what you don't know about.
8. Close known gaps fast. If an audit, a vendor, or your IT person flagged a problem, put a date on fixing it, and track how long it stays open.

Get a $299 cyber hygiene check

If you're not sure where your business stands, that's normal. Hawkcrest Cyber is a veteran-owned cybersecurity consulting practice that works with businesses nationwide, fully remote. Our cybersecurity hygiene check is a flat $299. We'll review the basics above with you, show you what's open, and give you a clear, prioritized list of what to fix first, in plain English.

Request a hygiene check or email [email protected]. Want a head start? Try our free Security Checkup or learn about our Risk Assessment.

Sources: CenterPoint Energy SEC Form 8-K (September 2026); KHOU (Oct. 15, 2026). Attacker claims as reported by BleepingComputer and Help Net Security and not confirmed by CenterPoint.