A business can keep operating while a cybersecurity incident unfolds.
Phones still ring. Employees keep working. Customers receive services.
That does not necessarily mean customer information is safe.
CenterPoint Energy’s recent data breach offers business owners a reminder: operational uptime and data security are two different measures of protection.
What happened at CenterPoint Energy?
In a September 14, 2026, SEC filing, CenterPoint Energy disclosed that an unauthorized third party had obtained personal information belonging to some customers through an external-facing system.
The company said it activated its incident response procedures, brought in outside cybersecurity experts, and notified law enforcement. Its electricity and natural gas services continued without disruption. The filing did not identify the specific technical vulnerability behind the incident.
On October 14, the Houston Chronicle reported that a Texas Attorney General listing identified 1,062,060 affected Texans and listed names, addresses, Social Security information, and driver’s license numbers among the information involved. CenterPoint said its investigation was continuing.
Why business owners should pay attention
An outage is visible. Employees cannot log in, transactions stop, or customers cannot reach you.
Unauthorized access to information may be less obvious.
The practical lesson is to ask two separate questions:
Can our business keep running?
Are we protecting the information entrusted to us?
Your cybersecurity planning needs to address both.
Start with the systems customers can reach
Customer portals, online forms, and other internet-facing tools deserve deliberate attention because they connect your business to the outside world.
Ask your IT provider:
• Which of our systems are accessible from the internet?
• What customer information can those systems access?
• Who is responsible for maintaining and reviewing them?
• How would we identify and investigate unusual activity?
• Can we disable access quickly if a concern arises?
These are general review questions—not claims about the technical cause of CenterPoint’s breach.
Review how much information you retain
Every business should understand what customer information it collects, where it is stored, and who can access it.
Review whether older records still serve a business purpose. Establish an approved retention process that accounts for your obligations, and limit access according to employees’ responsibilities.
A clear picture of your data makes it easier to prioritize protection and investigate a potential incident.
Prepare for a breach that does not stop operations
Do not make a system outage the only trigger for your response plan.
Your team should also know how to report suspected unauthorized access, unusual data activity, or a credible claim that company information has been exposed.
Identify who coordinates the investigation, preserves relevant records, and approves communications. Keep essential response contacts accessible if normal tools become unavailable.
Ask better questions before customers ask them
“We’re still operating” is reassuring. It does not answer every security question.
Use this incident as a reason to review the systems and information behind your daily operations—and identify where you need clearer answers.
Contact Engler IT to discuss your cybersecurity needs and the steps your business can take to better protect customer information.