CenterPoint Energy disclosed to federal regulators on Sept. 14 that an unauthorized party obtained personal information belonging to some of its customers through an external-facing system, days after a post on a cybercrime forum advertised a data set the seller said covered roughly 7.5 million customer records.

The Houston-based utility, which delivers electricity and natural gas to about 7 million metered customers across Indiana, Minnesota, Ohio and Texas, said in a Form 8-K that it learned of the online post this month and opened an investigation with outside forensic experts. It has reported the matter to law enforcement.

Operations were not affected. The filing states that the comp...