Feds investigate cyberattacks on U.S. water systems

Federal agencies have issued a renewed warning for municipal water and wastewater systems after cyberattacks targeted facilities in at least seven states. These incidents are believed to involve hackers affiliated with Iran, who are reportedly aiming at critical infrastructure.

This situation might not typically be on your radar if you just pay your bills and move on. But, think about it: those monthly bills are tied to a whole lot of personal information like your address, phone number, and billing history. That’s why a recent breach at CenterPoint Energy is concerning. Even if you’re not a customer, it’s still worth being aware of.

According to CenterPoint, unauthorized access to personal information from some customers occurred through an external system. A hacker has come forward claiming they’ve stolen around 7.49 million records, which apparently include addresses, account numbers, billing details, and even partial Social Security numbers.

However, there’s a caveat. While CenterPoint has confirmed that data was taken, they haven’t verified the hacker’s figure of 7.49 million nor the specifics of what information was accessed. It raises questions about the true scale of the breach. Here’s what we know so far.

CenterPoint Energy admits to data theft

CenterPoint Energy revealed the breach in a filing with the U.S. Securities and Exchange Commission on September 14. They became aware of the claims made by a third party about possessing customer data.

The company then activated its internal protocols for cybersecurity incidents and involved outside experts for an investigation. They confirmed that personal information was accessed through an external system, but haven’t specified how many customers are affected or what exact information was taken. They’re planning to notify customers and regulators once they fully understand the incident.

CenterPoint directed inquiries about the hacker’s claims back to the SEC filing, reiterating that their statement speaks for itself, without further elaboration.

Fortunately, there is some good news for those relying on CenterPoint for gas or electricity; their services continued to operate normally throughout this incident. They also do not anticipate significant financial repercussions from the breach.

The hacker claims vast number of records taken

The figure of 7.49 million comes from the hacker, who identified themselves as “4d722e4d656f77” to BleepingComputer. They stated that these records include:

• Names
• Phone numbers
• Service and billing addresses
• CenterPoint account numbers
• Billing amounts
• Partial Social Security numbers

They also leaked this data, claiming CenterPoint ignored their attempts to reach out. While CenterPoint has confirmed data theft, they haven’t verified the hacker’s list of specific data or the overall number of records stolen. Importantly, the claimed tally doesn’t necessarily mean that many individuals are affected, as one account could relate to multiple entries.

Details on how the data was allegedly accessed

The hacker’s methods provide interesting insights into the breach. They mentioned that they accessed the information by cycling through millions of IDs via a public API associated with CenterPoint.

APIs are common in allowing different software to communicate. The hacker asserted that CenterPoint’s API lacked sufficient protections against automated data requests, specifically mentioning the absence of effective rate limiting or a web application firewall. However, CenterPoint’s SEC filing does not confirm these claims.

What is clear, as stated by CenterPoint, is that the unauthorized access occurred through an external system. So, until more details emerge, the method provided by the hacker should be treated cautiously.

The value of stolen utility records

You might think that utility account information isn’t very sensitive compared to bank details, but it can provide scammers with essential information to craft convincing calls or messages. Imagine receiving a call where the caller knows your name and address, along with your account details—suddenly, it feels much more credible.

Criminals can easily combine details from different breaches to make scams even more convincing. Even a small piece of information can enhance their schemes significantly. This is why it’s important to recognize that breaches can all contribute to a larger identity theft picture.

Be wary of suspicious communications

While the primary concern might not be someone opening an account in your name immediately, the risk is there for phishing messages. After a breach, scammers often seize the opportunity to exploit confusion.

You might get messages claiming urgency, like needing to verify your account due to the breach, or warnings about imminent disconnections unless payment is made. Be wary of any message that pushes for quick action or asks for your personal details.

Steps to take after the CenterPoint breach

If you are a CenterPoint customer or just curious about responding to any utility breach, here are some practical steps you can take:

1) Look for an official breach notice

CenterPoint has stated they will notify affected customers appropriately. Should you receive anything, scrutinize it for details on what data was involved and if they offer any protective measures.

2) Consider a credit freeze

If sensitive information was involved, consider putting a credit freeze with the major credit agencies. This can help prevent new accounts from being opened in your name, although it won’t stop existing account fraud.

3) Check your financial records

Review your credit reports for unfamiliar accounts or inquiries, and keep an eye on your bank statements. Contact your financial institution if anything strange pops up.

4) Secure your online accounts

Make sure your main email account is secure because it can be pivotal for resetting passwords on other sites. Use strong passwords, enable two-factor authentication, and leverage a password manager.

5) Treat urgent shutoff claims with caution

If you receive threats about immediate payment or disconnection, take a step back. Confirm directly with the utility through official channels.

6) Use robust antivirus software

Scam-related emails can lead to serious security issues. Good antivirus software can help identify malicious attempts and safeguard your devices.

7) Limit public personal information

Consider reducing your online presence. While this won’t nullify already stolen data, lesser availability of your personal info can help thwart scammers.

8) Monitor for identity theft

Using identity theft protection services can alert you to potential misuse of your data, assisting in addressing issues as they arise.

Takeaway

Utility accounts can reveal more about our identities than we might think, making it essential to stay vigilant. Though we don’t yet know the full extent of the CenterPoint breach, remaining alert and taking preventative measures is wise. Keep an eye on your accounts, think about credit freezes, and be skeptical of unexpected requests. After all, we often can’t choose our utility providers, making it crucial to safeguard the data we share with them.