What happened
Southern Company, one of the largest US energy companies (more than 9 million customers, owner of Georgia Power, Alabama Power and Mississippi Power), is notifying about 400,000 customers that an unauthorized third party accessed their account information through its online customer portal.
- About 300,000 accounts belong to Georgia Power (out of 2.8 million customers).
- About 100,000 belong to Alabama Power (out of 1.6 million).
Georgia Power began notifying customers on October 5, 2026; according to the AJC, the portal was hit the week before.
What data was exposed
According to the company's notice, the attacker accessed "limited" information: name, mailing address, phone number, email, the last four digits of the Social Security Number (SSN) and other basic account details.
Bank account numbers, payment card numbers and driver's license numbers were not accessed.
Response
- The activity was stopped on detection and law enforcement was engaged.
- The company says it found no ongoing unauthorized access.
- Those affected are notified by email and mail and offered one year of free credit monitoring (through Equifax, for Georgia Power).
- The company has not said how the attacker got in or who it is.
Why it matters
Nobody touched the power grid, but the case shows that customer portals of essential services are a valuable target. With name, address, phone, email and part of the SSN, scammers can craft very convincing phishing, such as fake power bills threatening disconnection, a scam already common in the US.
Customer portals are often hit by credential stuffing (passwords leaked from other sites) or by authorization flaws in the application. The company hasn't confirmed which applied here.
What customers should do
- Be wary of messages about power shutoffs or urgent payments; always confirm via the official number.
- Change your portal password and don't reuse it on other sites.
- Turn on two-step verification if available, and take up the credit monitoring.
Lessons for businesses
- Protect portals with MFA, rate limiting and anomalous-login detection.
- Test access control in the API (one user must not see another's data).
- Show customers only what's needed: SSN digits rarely need to be visible in a portal.
Sources
- SecurityWeek (7/10/2026): https://www.securityweek.com/georgia-power-alabama-power-data-breach-hits-400000-accounts/
- AJC (Oct 6, 2026): https://www.ajc.com/business/2026/10/georgia-power-data-breach/
- FOX 5 Atlanta (5/10/2026): https://www.fox5atlanta.com/news/georgia-power-notifies-300k-customers-about-suspicious-online-activity
Want to protect your company's customer portal against intrusions? KGA IT offers a free consultation: kga-it.com.