Southern Company says an unauthorized third party accessed limited information tied to utility customer accounts through its online customer portal. The company says the incident affected about 400,000 accounts across its utility territory, including roughly 300,000 Georgia Power customers and 100,000 Alabama Power customers, according to reports published this week. [2] [3] [4]
The company’s notice says the information may include names, mailing addresses, phone numbers, email addresses, the last four digits of Social Security numbers and other basic account details. It says bank-account numbers, payment-card numbers and driver’s-license numbers were not accessed. [1] The intrusion date and the way the third party reached the portal have not been disclosed publicly.
Key points
- Southern Company says about 400,000 utility accounts were affected, including about 300,000 Georgia Power and 100,000 Alabama Power accounts. [2] [4]
- The potentially accessed information is limited contact and account data; the company says bank, payment-card and driver’s-license numbers were not involved. [1]
- Mississippi Power is named in the company notice, but a separate Mississippi customer count has not been released. [1] [2]
- Affected customers are being contacted by mail and email and offered one year of Equifax credit monitoring. [1] [4]
What happened
Southern Company, the parent company of Georgia Power and Alabama Power, says its monitoring detected activity in which an unauthorized third party accessed certain information from a limited group of customer accounts. The access occurred through the company’s online customer portal, but the company has not publicly described a vulnerability, stolen password, malware family or other technical cause. [1] [2]
The public account is therefore narrower than the word “breach” can sometimes suggest. The available sources establish unauthorized access to account information. They do not establish that attackers changed bills, disconnected service, accessed payment systems or used the information for identity theft. The company says it took immediate steps to address the issue, notified law enforcement and has not identified evidence of ongoing unauthorized access based on its review to date. [1] [4]
Reports from the Atlanta Journal-Constitution and Alabama broadcaster ABC 33/40 place the affected population at about 300,000 Georgia Power customers and about 100,000 Alabama Power customers. SecurityWeek also reports the combined total and says Mississippi Power appears in the company’s notice without a separate public figure. [2] [3] [4]
What information may be exposed
Southern Company describes the accessed information as limited customer account information. Its notice lists a customer’s name, mailing address, phone number, email address or the last four digits of a Social Security number, as well as other basic account details. The wording matters: these are categories that may have been accessible based on the investigation, not a statement that every affected account contained every listed field. [1]
NBC 15, reporting on Alabama Power, also says business customers’ tax-identification numbers may be included in the possible fields. That detail is attributed to the reported company account and should not be broadened into a claim that full Social Security numbers or tax records were exposed. [5]
The company expressly excludes bank-account numbers, payment-card numbers and driver’s-license numbers from the affected information. SecurityWeek, AJC, ABC 33/40 and NBC 15 all report the same distinction. [2] [3] [4] [5] That distinction can help customers understand the stated scope, but it does not remove the need to treat unexpected messages cautiously: contact details and partial identification data can still be used in convincing impersonation attempts.
Why it matters
Utility accounts are closely tied to households and businesses, so a customer may reasonably want to know whether a notice is genuine and what information could be used against them. Southern Company says it is notifying affected customers directly by U.S. mail and electronically through email addresses already on file. It is also offering one year of free credit monitoring through Equifax to customers whose information was accessed. [1]
Customers should verify any message by going directly to the official Georgia Power or Alabama Power website, using the customer-service number on a bill, or contacting the utility through a known channel rather than clicking an unexpected link. Southern Company’s own notice warns that impostors may claim to represent the utility and says the company will not threaten immediate disconnection or demand payment over the phone. [1]
The same caution applies to billing messages that appear urgent. An October 8 cybersecurity report framed the exposed contact information as a possible basis for impersonation or billing scams, while also directing readers back to the company’s warning and first-party notice. [6]
The episode also illustrates why the account total needs careful wording. The reported 400,000 figure is a company-provided approximate count carried by several independent outlets, not a publicly released forensic audit. The number is important, but so are its qualifiers: “approximately,” the split between Georgia and Alabama, and the unresolved Mississippi figure. [2] [3]
What remains uncertain
The company has not said when the unauthorized access began, how long it lasted or how the portal was reached. SecurityWeek specifically notes that the intrusion timing and access method were not disclosed in the company’s public account. [2] Without those details, it is not possible to say whether the activity exploited a software flaw, compromised credentials, abused a customer session or used another route.
The public materials also do not identify a threat actor, ransomware group or motive. No retrieved source supports saying that the incident was a ransomware attack. Nor do the sources show that the exposed information was published, sold or used to commit fraud. The company’s statement that it has found no evidence of ongoing unauthorized access is a status report from an investigation still in progress, not a guarantee that no customer harm can occur. [1] [4]
Mississippi Power is included in the first-party notice, but the retrieved reports do not provide a separate count for that utility. The 300,000 Georgia and 100,000 Alabama figures should therefore be presented as the reported approximate breakdown, not as a definitive reconciliation of every account across all three utilities. [1] [2]
What happens next
Southern Company says it is continuing its investigation, working with law enforcement and monitoring its systems around the clock. Customers who receive a direct notice should follow the instructions in that letter or email for credit-monitoring enrollment, while independently confirming that any contact is genuine. [1]
Further updates may clarify the incident timeline, the portal access method, the number of Mississippi Power accounts involved and whether investigators found evidence of misuse. Until then, the most accurate description is limited unauthorized access to utility-account information affecting approximately 400,000 accounts, with financial-card and driver’s-license data excluded by the company’s notice. [1] [2] [5]
