Southern Company, the Atlanta-based holding company behind Georgia Power and Alabama Power, told customers on 6 October 2026 that an unauthorized third party had gotten into its online customer portal. Roughly 300,000 Georgia Power accounts and 100,000 of Alabama Power’s 1.6 million accounts were affected; Mississippi Power, the company’s third utility subsidiary, was also touched, though Southern Company hasn’t disclosed a specific number for it. Names, mailing addresses, phone numbers, email addresses and the last four digits of Social Security numbers were exposed. Bank account numbers, payment card numbers and driver’s license numbers were not, the company says.
What a utility’s customer portal actually holds
Southern Company serves power to millions of households and businesses across the Southeast, and the breach didn’t touch grid operations, metering systems or anything resembling the industrial control side of the business — this was a breach of the customer-facing web portal people use to view and pay their electric bill. That distinction matters for scope: nothing here suggests an attacker got anywhere near the systems that actually deliver power. But a utility’s customer portal is still a single, centralized repository tying together a verified name, a physical address and a partial Social Security number for every one of its ratepayers — a dataset useful less for stealing electricity than for downstream identity fraud and, specifically, for impersonating customers to those same utilities during account-recovery calls that ask for exactly that combination of details to verify identity.
Georgia Power has not disclosed how the attacker got into the portal. SecurityWeek’s reporting and the company’s own statements stop at “unauthorized third-party access”; there’s no public detail on whether this was credential stuffing against reused passwords, a stolen employee credential, or a flaw in the portal’s own authentication. Spokesperson Jacob Hawkins told the Atlanta Journal-Constitution only that “we understand the trust our customers place in us and remain committed to protecting their information” — a statement that acknowledges the breach without explaining its root cause.
A tight timeline, by breach-notification standards
What is public is the sequence of disclosure. Southern Company detected the activity through its own monitoring, notified the Georgia Public Service Commission on Friday, 4 October, and notified affected customers by mail and email on Monday, 6 October — a two-day gap between regulator and customer notice, and a company statement that it “took immediate steps to stop the activity” upon detection and brought in law enforcement. Georgia law requires breach notification “in the most expedient time possible and without unreasonable delay,” with no fixed statutory deadline and no requirement to notify a state agency at all — Southern Company notified the PSC voluntarily, as the body that oversees utility security planning rather than as a legal breach-reporting obligation. PSC Chair Jason Shaw said the commission is monitoring the situation and has asked Georgia Power for continual updates.
That speed stands out next to recent utility and infrastructure-adjacent breaches that took far longer to reach the public. Oracle Health’s Cerner breach wasn’t disclosed with a real victim count until eighteen months after the intrusion began, and a breach of the Pentagon’s personnel data system ran undetected for roughly nine months before anyone caught it at all. Southern Company’s single-week gap between detection and public notice — even without a public root cause — is closer to the standard those incidents fell well short of.
Partial data, real risk
Southern Company’s own framing emphasizes what wasn’t taken: no full Social Security numbers, no bank details, no card numbers, no driver’s license numbers. That’s a real mitigation — a thief can’t open a credit line with a name, an address and four digits of a Social Security number alone. But those four digits are also exactly what many call centers, including utilities’ own customer service lines, use as an identity check before letting a caller make changes to an account. A dataset of names, addresses and partial SSNs tied together is a ready-made toolkit for impersonating a customer to their own utility, or to any other company using the same thin verification standard — which is most of them. The company is offering one year of free credit monitoring through Equifax, a standard response that addresses credit-fraud risk without addressing the account-impersonation risk the specific data combination enables.
The lessons that generalise
“Only partial data was exposed” is a mitigation claim, not a safety claim. The last four digits of a Social Security number, paired with a verified name and address, are frequently sufficient to pass identity verification at call centers — including the breached company’s own. Breach notices that lead with what wasn’t taken can understate what the remaining data still enables.
Voluntary regulator notice can move faster than any legal deadline would require. Georgia has no statutory requirement to notify a state agency after a breach, yet Southern Company notified its Public Service Commission two days before telling customers. That the fastest link in this disclosure chain was the one with no legal deadline attached is worth noting next to breaches where the legally mandated steps were the slow ones.
A customer portal breach and a grid-security breach are different threat models that get reported identically. “Southern Company data breach” reads, at a glance, like an infrastructure story. It wasn’t — it was a web-application breach of billing and account data, structurally closer to a retail customer-data incident than to an industrial-control compromise. Conflating the two risks either overstating the danger to grid reliability or, worse, understating it the next time a breach actually does reach operational systems.
Root-cause silence is now the default, not the exception. Southern Company’s disclosure, like Georgia Power’s, describes what happened and what was taken without saying how the attacker got in. That gap — common across most corporate breach notices — leaves every other company running a similar customer portal with nothing concrete to check against their own defenses.
Tech-Bee is an independent technology publication. This piece is drawn from reporting by SecurityWeek, the Atlanta Journal-Constitution, WBRC and WSB-TV on Southern Company’s October 2026 data breach disclosure.