CenterPoint Energy just handed attackers a million Texans’ identities.

Names, home addresses, Social Security numbers, and driver’s license numbers walked out of a company most customers treat as a bill, not a records warehouse. That is a cybersecurity failure because those fields remain useful long after the notification letter. Whoever holds the file can open credit, file returns, and pass the knowledge checks your bank still treats as authentication.

You know the rest of the choreography. The utility notifies. Credit monitoring gets offered. Your incident response timeline starts at detection and dies at the press page. The identities keep working for years after you close the ticket.

The same week, GhostAction operators compromised about 1,900 GitHub accounts and aimed the campaign at more than 30,000 repositories across roughly 3,000 users and organizations. GitGuardian recorded the spike on October 8 and 9, 2026. Researchers said the operators tried to pull 3,174 secrets out of public repositories’ CI.

Different industry.

Same architecture.

You parked identity-grade material in a system built to deliver something else. Bills. Builds. Meter reads. Pipeline logs. Then you expected threat-protection around the edge to make that choice safe.

It will not.

Customer Files Became a Cybersecurity Liability

Utilities collect identity documents because regulators, credit desks, move-in, and collections all want proof you are a real person at a real address. Fine. Keeping that proof in the same place as account numbers and kilowatt totals is a design decision, and it is a rotten one.

A billing platform is an availability system. It renders invoices, takes payments, and talks to field tools. Once SSNs and license numbers live there, every developer laptop, every vendor VPN, every analytics extract, and every “temporary” share becomes a path to a million-person identity kit.

Your firewall never sees that export as a special class of traffic. To the edge, a CRM dump looks like business. Threat detection tuned for malware callbacks and brute-force noise will not flag a help-desk contractor pulling a customer roster they were allowed to query.

That is how cyber security programs lose quietly. You spend on perimeter theater while the crown jewels sit in a table named CUSTOMER.

GhostAction is the developer edition of the same habit. CI exists to compile and ship. Secrets in those workflows are standing credentials for clouds, package registries, and signing keys. Public repos made the search trivial. You did the attackers’ inventory work for them.

Stop treating these as unrelated headlines. CenterPoint’s file and GitHub’s secret haul are both identity stores hiding inside operations.

Cut Identity Data Out of Operations

If you cannot drop a field without breaking a legal process, you still do not get to leave the raw value in the app that prints the bill. Tokenize it. Vault it. Retrieve it under dual control when a human actually needs it. That is security hardening that costs less than another dashboard.

Start this week with an inventory, not a strategy offsite. Every system that holds an SSN, government ID, full account number, API token, or cloud key is an identity store. If billing, customer information systems, or CI show up on that list, they belong in this week’s risk meeting.

Rotate like the secret is already public. Revoke tokens that have lived in CI logs, repo variables, or “temporary” pipeline files. Assume git history is hostile. Then shut the public runners and public logs that can print those values again.

Bind retrieval to a ticket, a person, and a time box. Billing clerks get a last-four and a token. Developers get short-lived job identities, not org-wide PATs sitting in YAML.

Put defense in depth on the data, not only the network. Encrypt at the field. Log every bulk export. Alert on result sets that look like a customer dump. Your SOC should treat a 50,000-row extract as an incident even when the query is authorized.

Do the ugly copy hunt. Schema dumps, vendor data maps, and the last three “we need it for collections” exceptions will show spreadsheets, lakes, and a CRM sandbox nobody owns.

Those copies are the breach.

Stolen Records Outrun Closed Tickets

Incident response for a utility dump starts after the records are already gone. You will not find a disk artifact that puts the SSNs back. Assume the file is public, lock downstream fraud rails, and shrink the next blast radius.

Call the banks and the bureaus with a concrete population, not a vibe. Force portal resets where customer logins reuse those identifiers. Watch new-account and change-of-address fraud against the same names. That work lasts quarters. Budget for it.

On the engineering side, stop measuring success as “we blocked the actor.” Measure whether last month’s access review could have produced the same export. If a contractor with a VPN and a report license can recreate the dump, your threat-protection stack is theater.

CenterPoint’s customers cannot patch their SSNs. Your developers cannot un-publish a secret that sat in CI for a year. The control that still works after the letter goes out is the one you used before anyone broke in: store less, store it elsewhere, and make bulk reads loud.

Run it like operations. Quarterly field inventories. Kill switches on exports. No SSN in the same database an outage-restoration tool can query. No cloud key in the same YAML a forked public workflow can read.

You will still get breached. Hand over a tokenized customer ID instead of a driver’s license. That is the entire point.

Sources

• CenterPoint Energy Data Breach Impacts 1 Million Texans
• GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories