Southern Company Breach Exposes Data of 400,000 Utility Customers

Key points

• Southern Company, the parent of Georgia Power and Alabama Power, confirmed a data breach affecting approximately 400,000 customer accounts.
• The breach exposed names, addresses, phone numbers, email addresses, and the last four digits of Social Security numbers.
• Bank account numbers, payment card numbers, and driver's license numbers were not accessed.
• The company detected suspicious activity on its online customer portal and immediately took steps to stop the unauthorized access.
• Law enforcement has been engaged, and an investigation found no evidence of ongoing unauthorized access.
• Affected customers are being notified and offered one year of free credit monitoring and identity theft restoration services via Equifax.

Background

This incident follows a series of high-profile data breaches in late 2026, including a nine-month breach at the Defense Manpower Data Center exposing data of nearly 3 million military personnel and a security incident at Weverse affecting over 422,000 accounts. Cybersecurity experts have noted that utilities are increasingly targeted by cyberattacks, with federal officials warning that hackers linked to foreign governments are focusing on critical infrastructure. While this specific breach involved customer account information rather than operational systems, it highlights the persistent risks to utility providers.

How outlets are covering it

WBRC emphasized the impact on Alabama Power, noting that 100,000 of its 1.6 million accounts were affected. WSB-TV and Fox 5 Atlanta focused on Georgia Power, highlighting that 300,000 of its customers were impacted. CBS News Atlanta reported on the company's efforts to notify customers and warned against phishing scams, noting that Georgia Power has not released the exact date of the intrusion or the identity of the third party. All sources agreed that the breach was limited to specific personal data and did not include financial account details.

Why it matters

The breach affects a large number of customers across two major states, requiring them to monitor their credit and be vigilant against potential identity theft. It also underscores the ongoing cybersecurity challenges faced by utility companies, which are critical infrastructure targets. The provision of free credit monitoring is a standard response, but the scale of the breach highlights the need for robust security measures in the utility sector.

What to watch

Southern Company and its subsidiaries will continue to notify affected customers and provide credit monitoring services. Law enforcement will continue to investigate the breach, and the company will work to prevent future incidents. Customers are advised to monitor their accounts for unusual activity and be cautious of phishing attempts.