Your Power Company Was Hacked: 400,000 Georgia and Alabama Utility Accounts Exposed

Your Utility Account Was a Target All Along

Your power company knows a lot about you. Your name, your home address, your phone number, your email, and enough of your Social Security number to confirm your identity. That data sits inside a customer portal, the same kind of web account you use to pay your bill and report an outage. And that portal just got breached.

On or around October 5, 2026, an unauthorized party broke into Southern Company's online customer portal. Southern Company is the parent of Georgia Power, Alabama Power, and Mississippi Power. About 400,000 accounts were compromised: roughly 300,000 Georgia Power customers and about 100,000 Alabama Power customers, with some Mississippi Power accounts included.

The company says it detected and stopped the suspicious activity. It found no evidence of ongoing unauthorized access. Law enforcement has been notified. An investigation is underway.

That is the good news. The breach stopped. But the data is already gone.

What Did They Actually Take?

The attackers got names, mailing addresses, phone numbers, email addresses, and the last four digits of Social Security numbers or business tax IDs.

They did not get full Social Security numbers, bank account numbers, payment card numbers, or driver's license numbers.

Read that second paragraph again, because it matters. The most catastrophic data, the things that let someone open a new credit card or drain a bank account outright, was not exposed. That distinction changes your risk level, but it does not eliminate it.

Why Four Digits of Your SSN Is Still Dangerous

Here is how identity theft actually works. Fraudsters rarely need everything at once. They build a file on you across multiple breaches and data broker records. Four digits of your SSN, your home address, your phone number, and your email address form a very useful starting kit.

A scammer can use that combination to pass identity verification over the phone at a financial institution. They can use it to social-engineer their way through a customer service call. They can send you a convincing phishing email, one that includes your address and partial SSN to appear legitimate, and trick you into handing over the rest.

The breach also confirms something useful to attackers: that you are a Southern Company customer at a specific address. That is targeting information. Expect phishing attempts in the weeks ahead that reference your "utility account."

The Numbers

• 400,000 accounts total were affected.
• ~300,000 belong to Georgia Power customers.
• ~100,000 belong to Alabama Power customers.
• Southern Company is notifying affected customers by U.S. mail and email.
• Affected customers receive one year of free credit monitoring.

What to Do Right Now

1. Accept the free credit monitoring, but don't stop there.

Southern Company is offering one year of free credit monitoring to affected customers. Take it. But credit monitoring only tells you after something has already happened. It is not prevention.

2. Place a credit freeze with all three bureaus.

A credit freeze is free, takes about ten minutes, and blocks anyone from opening new credit in your name, including you, until you lift it. Do this at Equifax, Experian, and TransUnion directly through their websites. It is the single most effective protection against new-account fraud, and it costs nothing.

3. Watch for phishing that looks personal.

Any email or text referencing your "utility account," your address, or a partial SSN in the coming weeks should be treated as suspicious. Do not click links. Go directly to your utility's official website by typing the address yourself.

4. Enable two-factor authentication on your Southern Company account and your email.

Your email account is the master key to your digital life. If an attacker resets your passwords, they do it through email. Use an authenticator app, not SMS, for two-factor authentication wherever you can. Passkeys are even better where supported.

5. Check your credit reports now.

You can pull free reports from all three bureaus. Look for accounts you did not open, addresses you have never lived at, or inquiries you do not recognize.

6. Consider a data-removal service.

Your name, address, and phone number from this breach will circulate through data brokers for years. Data-removal services send opt-out requests on your behalf on a recurring basis. They are not free, but they reduce the surface area for future targeting.

The Bigger Pattern Here

Utility companies are not banks. They are not payment processors. Nobody thinks of them as a high-value target. That is exactly why they are one.

The same infrastructure, smart meters, payment portals, billing systems, that makes managing your account convenient also concentrates personal data in one place. That concentration is the target. And these portals often lag years behind the security standards that financial institutions maintain, simply because the regulatory pressure and competitive incentive to move faster are lower.

Essential services hold essential data. Your power company. Your water company. Your healthcare provider. Your insurance carrier. Most people do not have a mental model of these organizations as security risks. Attackers do.

The breach affecting 400,000 utility customers in two states is a reminder that your personal data is not just in the places you think to protect. It is in the systems you depend on daily without thinking about them at all.

Do this now:

• Place a credit freeze at Equifax, Experian, and TransUnion (free)
• Enable two-factor authentication on your utility portal and your email
• Pull your free credit reports and scan for anything unfamiliar
• Be skeptical of any email or call that references your utility account in the next 90 days
• If you receive a notification letter from Southern Company, follow the instructions to enroll in the free credit monitoring

Sources

• securityweek.com
• wbrc.com