“Not Reasonably Likely to Be Material”: What CenterPoint’s Filing Teaches Boards About Saying It Before You Know It

A hacker posts online claiming to hold millions of a utility’s customer records. Within days, the company files a public notice with the Securities and Exchange Commission. It confirms that an unauthorized party obtained customer information. It also says it does not believe the incident is reasonably likely to have a material impact on its finances.

That is the sequence at CenterPoint Energy, the Houston-based utility that serves roughly 7 million customers across Texas, Indiana, Minnesota, and Ohio. The filing is a good case study for every board, and the most interesting sentence in it is the one about materiality.

What we know, and what we don’t

CenterPoint’s SEC filing, dated September 14, 2026, says the company “became aware of an online post by a third party claiming to have obtained a data set containing certain of the Company’s customer information.” The company says an unauthorized third party obtained personal information relating to “a portion of the Company’s customers” through an external-facing system. It says it activated incident response protocols, brought in outside experts, reported the matter to law enforcement and regulators, and plans to notify affected customers as legally required. Electric and gas delivery was not disrupted.

Everything beyond that is the attacker’s claim, not established fact. A forum poster using an alias claimed to have extracted about 7.49 million customer records through an unprotected web interface. Security news outlets reported the claim, and it includes fields such as names, addresses, account numbers, and partial Social Security numbers. CenterPoint’s filing does not confirm the record count, the specific data fields, or the technical method. The company’s own filing says the investigation is ongoing.

The sentence worth studying

The filing states that, as of its date, the company “does not believe it is reasonably likely that there will be a material impact on the Company’s financial condition or results of operations.”

That may prove true. But the same filing carries a caution in its forward-looking statements: a risk “that the scope of the Incident is greater than initially expected.” In plain English, the company is telling investors both that it expects no material impact and that it does not yet know how big this is.

I am not criticizing CenterPoint. Companies are under pressure to disclose quickly, and the filing was made under Item 8.01, the “other events” section, rather than the mandatory cyber-incident item, Item 1.05. That is a common and legitimate choice when materiality has not been established. The point is what this teaches every board: you will be asked to say something about materiality before your forensics are done. The time to decide how you will handle that moment is now, not during the incident.

Compliance versus security

This is the Cyber Risk Is Business Risk theme in miniature. A company can do everything the disclosure rules ask: file promptly, describe the response, notify regulators. It can still face a bigger problem underneath. Disclosure compliance tells investors what the company knows. It does not tell anyone whether the front door was locked.

Materiality is also not only about dollars. Regulators, plaintiffs, and customers judge a breach on more than the current-quarter financial impact. Customer trust, regulatory scrutiny, and litigation exposure can arrive months after the first statement. A reassuring line written on day three can look different on day ninety if the scope grows.

The Three Questions, applied

In the book, I give boards three questions to ask about any cyber risk: What are we protecting? Who is responsible? Are we ready?

What are we protecting? For a utility, most executives think of the grid. But customer data, billing systems, and the web interfaces that serve them are also core assets, and they are exposed to the internet by design.

Who is responsible? Someone has to own the statement “not reasonably likely to be material,” and someone has to own revisiting it. The filing is a public commitment, and the board should know exactly who made the call.

Are we ready? Ready means more than having an incident response plan. It means being able to say what you know, and how sure you are, within days, while the investigation is still open. It also means knowing that the attacker’s claim, if accurate, is that an interface serving customers lacked basic protections. Whatever the facts turn out to be here, your public-facing systems are the ones attackers can reach without stealing a single password.

What to ask your CISO this week

1. Who owns the materiality call? Is there a named process that includes the CISO, general counsel, CFO, and disclosure committee, and does the board know who sits in it?
2. What would we say on day three? Do we have pre-approved language that is accurate about what we know and clear about what we don’t, so we are not improvising under pressure?
3. What is our re-evaluation trigger? If scope grows, who is responsible for revisiting the materiality determination, and how quickly?
4. Which of our internet-facing systems return customer data? Have those been tested for basic controls such as authentication and rate limits? If you cannot get a clear answer, that is your answer.
5. How would we learn about a breach? In this case, the company says it became aware through an online post. Do we have a way to find out before the attacker’s announcement does it for us?

The bottom line

Boards often ask, “Is this material?” The better question is, “What do we know today, how sure are we, and what will we say if the answer changes?” A confident statement made before the scope is known is defensible. It becomes a liability only when nobody is assigned to revisit it.