Privacy
Georgia Power and Alabama Power Data Breach Exposes 400,000 Customer Accounts
Southern Company is notifying 400,000 customers of Georgia Power and Alabama Power that some of their account details were accessed by an unauthorised party. No payment information was exposed.
Ross GrantUpdated 2 min read
The short version
About 400,000 customers of Georgia Power and Alabama Power have had some of their account details accessed by an unauthorised person. The information includes names, contact details and part of their Social Security number, but not payment or bank details. The company is offering free credit monitoring. It is not yet clear how the breach happened.
By the numbers
- 400,000customer accounts affectedSecurityWeek
- 300,000Georgia Power accounts affectedSecurityWeek
- 100,000Alabama Power accounts affectedSecurityWeek
- 1 yearfree credit monitoring offered to affected customersSecurityWeek
What happened?
Southern Company is notifying about 400,000 customers of Georgia Power and Alabama Power that their account information was accessed by an unauthorised third party. The breach involved names, contact details and the last four digits of Social Security numbers, but not payment or bank information. The company is offering free credit monitoring to those affected.
What was accessed
Southern Company, which owns Georgia Power and Alabama Power, says about 400,000 customer accounts were affected by a recent data breach. The company is notifying those affected by mail and email. According to SecurityWeek (opens in a new tab), roughly 300,000 of the affected accounts belong to Georgia Power customers, and about 100,000 are Alabama Power accounts. Mississippi Power was also named as affected, but no numbers have been given for its customers.
The company’s public notice says the attacker accessed “limited customer account information.” This includes names, mailing addresses, phone numbers, email addresses, the last four digits of Social Security numbers, and other basic account details. Southern Company says no bank account numbers, payment card numbers, or driver’s licence numbers were exposed.
How the breach was discovered and handled
Southern Company has not said when the breach took place or how the attacker gained access to its online customer portal. The company says it detected the unauthorised access and took immediate steps to stop it. Law enforcement has been contacted. Impacted customers are being offered a year of free credit monitoring.
Who is affected and what should they do?
If you are a customer of Georgia Power or Alabama Power, you may receive a notification by mail or email. The company says only certain account details were accessed, not financial information. Still, the last four digits of a Social Security number can sometimes be used in identity theft attempts, especially when combined with other personal information.
Customers should watch for suspicious emails, texts, or phone calls. Be cautious if anyone asks for more personal information or claims to be from the utility. Southern Company is offering free credit monitoring for a year, which can help detect signs of identity theft.
What is still unclear
At this time, it is not known how the attacker got into the customer portal or exactly when the breach occurred. Southern Company has not released details about the method used or whether any other subsidiaries were affected. Only one news outlet has reported the incident so far, and there is no confirmation yet from government agencies or independent sources.
What happens next
Southern Company says it is working with law enforcement and continuing its investigation. Customers should expect further updates if more information becomes available. Under US state laws, companies that suffer data breaches are typically required to notify affected residents. Regulators can also investigate and impose fines if companies are found to have failed in their duty to protect customer data.
Claimed vs confirmed
- Confirmed
400,000 customer accounts were accessed by an unauthorised third party.
Southern Company confirmed in its public notice, as reported by SecurityWeek, that roughly 400,000 accounts were affected.
- Confirmed
No payment card, bank account, or driver’s licence numbers were exposed.
Southern Company stated that only limited account information was accessed, not financial or driver’s licence data.
The impact
- Money
- No direct financial losses have been reported. Southern Company may face costs for credit monitoring and possible regulatory fines. Under US law, fines for data breaches can be significant if negligence is found.
- Reputation
- A breach of this size can damage trust in Southern Company and its subsidiaries, especially as utilities hold sensitive customer data. The company’s response and transparency will influence public perception.
- Customers
- Customers’ personal details, including names, contact information and part of their Social Security number, were exposed. While no payment details were leaked, customers should be alert for scams and consider using the free credit monitoring offered.
Why it matters
This breach affects hundreds of thousands of utility customers, exposing personal information that could be used in scams or identity theft. Even though payment details were not leaked, the exposure of names, addresses and Social Security number fragments can still put people at risk.
How does it work?
The attacker accessed customer account information through Southern Company's online customer portal. The company has not disclosed how the attacker gained access or what vulnerability was exploited.
Key points
- 400,000 Georgia Power and Alabama Power customer accounts were affected.
- Names, contact details and last four digits of Social Security numbers were accessed.
- No payment card, bank account or driver’s licence numbers were exposed.
- Southern Company is offering a year of free credit monitoring to affected customers.
- It is not yet clear how the attacker gained access or when the breach occurred.
Sources
SecurityWeek
Reference
