Georgia Power Data Breach: 400,000 Southern Company Accounts Hit

A Georgia Power customer opened an email that said her data had been exposed, offered free credit monitoring, and told her to call a number and click a link. "And I stopped and I'm like, that's a scam," she told WTVM in Columbus, Georgia. She almost deleted it.

The email was real. Georgia Power's parent, Southern Company, is telling about 400,000 customers that someone got into their utility account information. Her instinct was still right, and that is every affected customer's problem now: the genuine notice and the fakes that follow arrive in the same inbox and ask for the same clicks.

Key Takeaways

• Southern Company told news outlets on October 5, 2026 that an unauthorized third party accessed limited information about the accounts of approximately 400,000 customers through its online customer portal.
• Georgia Power is notifying roughly 300,000 of its 2.8 million customers, roughly 100,000 of Alabama Power's 1.6 million accounts are affected, and Mississippi Power is named in the notice with no number.
• The accessed fields are name, mailing address, phone number, email, the last four digits of Social Security numbers and other basic account details; the company says bank account, payment card and driver's license numbers were not accessed.
• Southern Company's written notice gives no breach date and no account of how the intruder got in, although AL.com reports that a recorded line says the breach happened in September.
• Equifax credit monitoring is free for one year to affected customers, and notices arrive by U.S. mail and by email, a channel utility impersonators also use.

What Happened in the Georgia Power Data Breach?

An unauthorized third party accessed customer account information held by Southern Company, the Atlanta energy group that owns Georgia Power, Alabama Power and Mississippi Power. In a statement carried by AL.com on October 5, the company said it "recently detected suspicious activity involving our online customer portal" and that the intruder reached "certain, limited information" on about 400,000 customers.

Georgia Power said that Monday it was telling roughly 300,000 of its 2.8 million customers, according to the Atlanta Journal-Constitution. SecurityWeek puts the Alabama Power share at roughly 100,000 more. Southern Company says it stopped the activity, engaged law enforcement and has "not identified any evidence of ongoing unauthorized access."

The public notice is thinner than the press statements. We read all three versions on southerncompany.com, one per utility, built from a single template. None states a customer count or mentions the portal. Each describes only "a limited group of customers."

Who Is Affected, and What Data Was Accessed?

Customers of all three Southern Company electric utilities are affected, and Georgia Power carries the largest share.

• Georgia Power: roughly 300,000 of 2.8 million customers, per the AJC. That is about one in nine.
• Alabama Power: roughly 100,000 of 1.6 million accounts, per SecurityWeek. That is about one in sixteen, which puts Georgia Power's affected share at about 1.7 times Alabama Power's. No source we reviewed explains the difference.
• Mississippi Power: named as affected in the notice. No figure has been released.

The Georgia Power notice lists what the intruder reached: "name, address, phone, email, or last 4 digits of Social Security number, and other basic account details." It says bank account, payment card and driver's license numbers were not included.

That "or" matters: AL.com describes the last four digits of some customers' Social Security numbers, not all. Local stations WALA and NBC 15 report that the company's list also covers tax ID numbers for business customers, which the web notice does not mention. The company has not said what "other basic account details" covers.

When Did the Breach Happen, and How Did the Attacker Get In?

Southern Company has published neither a date nor a cause. Its notice says only that it "recently discovered" the access through "active, ongoing monitoring," and SecurityWeek wrote that the company "has not said when the intrusion took place or how the attacker gained access to the portal."

Fragments exist. AL.com reported that a recorded line says the breach happened in September. The AJC wrote on October 6 that hackers hit the portal "last week" and that the utility spoke with its regulator on Friday afternoon. Taken literally, both can be true only for the last days of September, but neither comes with a date.

We checked one more thing. When we requested the three notice pages on October 8, the web server's Last-Modified header read Friday, October 2, 2026: 17:35 GMT for the Alabama Power page and 18:08 GMT for the other two. A header shows when a file last changed, not when a page went live. The statements to news outlets came on Monday, October 5, and the AJC reports that Liz Coyle of the consumer group Georgia Watch said customers should have been alerted that Friday.

On method, no source we reviewed names a technique, and we will not guess at one. The notice advises against reusing passwords, but only as "a good personal security practice." It does not say passwords were involved.

Why Do the Last Four SSN Digits Matter?

The last four digits matter because they are the part of a Social Security number that is harder to infer, and this breach pairs them with a name, an address, a phone number and an email.

In 2009, Carnegie Mellon's Alessandro Acquisti and Ralph Gross published a study in PNAS on predicting SSNs from a person's date and place of birth. Working with death records, they "identified with a single attempt the first 5 digits for 44% of" the records of people born in the U.S. from 1989 to 2003. For people born between 1973 and 1988 the rate was 7%. Their point about masked numbers was blunt: the first five digits are the easier ones to infer, which leaves truncated SSNs "still predictable."

On that evidence, masking the front of the number protects the part that needs it least. For a phisher the value is simpler: a message that quotes your service address and those four digits reads as if the sender has your file open.

Why Email Users Should Care: The Fake Utility Bill Comes Next

The practical risk from this breach sits in the inbox. People reported losing $3.5 billion to imposter scams in 2025, and "nearly one in three fraud reports were about imposter scams," according to FTC data published on June 15, 2026. Utility impersonation is common enough that Utilities United Against Scams, a consortium of more than 150 U.S. and Canadian utilities, exists to fight that one fraud.

The generic scam asks you to believe a stranger who says your power is about to be cut. A scammer holding these fields can open with your name and service address, then quote four digits you thought only your utility had.

Stolen contact data does not expire either. In September 2026, Free Mobile customers in France were still receiving phishing emails that copy the carrier's real templates, two years after 24 million subscriber contracts were stolen.

How Do You Tell a Real Georgia Power Notice From a Phishing Email?

You cannot do it reliably from the email alone, so confirm through a channel you open yourself. Here is what is known about the genuine notice:

• It arrives as "an email and/or letter via U.S. mail," sent to the address the company already has.
• It carries instructions for enrolling in one year of Equifax credit monitoring. The WTVM customer's copy asked her to call a number and click a link, and the station reports the company says the email notices are real.
• No source we reviewed gives its sender address or subject line.

That last gap is awkward. Georgia Power's fraud protection page says billing emails come from G2georgiapps@southernco.com and outage emails from do-not-reply@georgiapower.com. It does not say which address the incident notice uses, and the notice itself sits on southerncompany.com. Three legitimate domains for one utility make "check the sender's domain" weak advice here.

The same page offers one usable tell: "We will never display your full-service address and account number together in an email or text message." The incident notice adds a second: "We will never threaten immediate disconnection or demand payment over the phone." Arizona's courts hit the same wall after their September breach, warning victims by email and text, the same channels scammers use.

What Should Affected Customers Do Now?

Verify the notice without using the email, then lock down your credit. Treat every payment demand as suspect.

1. Confirm it yourself. Type georgiapower.com, alabamapower.com or mississippipower.com into your browser, or call the dedicated line listed on the notice, 1-800-900-6021, on a weekday. Never use a number from a message.
2. Enroll in the Equifax monitoring once you have confirmed. Instructions are in the letter or email. If only an email arrived and you doubt it, call first.
3. Freeze your credit. It is free, and the FTC explains how to place a freeze with Equifax, Experian and TransUnion.
4. Change any password you reused on your power account. That is the company's own recommendation.
5. Hang up on shutoff threats. The FTC's utility scam guide says scammers demand wire transfers, cryptocurrency, payment apps or gift cards, and "Your utility company won't ask you to pay any of those ways." Call the number on your bill.
6. Report the fakes. Tell your utility, and file at ReportFraud.ftc.gov.

The Compliance Gap: Truncated SSNs and a Missing Date

Georgia's rule is loose. The AJC reports that companies must tell customers "in the most expedient time possible and without unreasonable delay," with no set deadline and no duty to tell any state agency. Public Service Commission Chairperson Jason Shaw told the paper the commission wants continual updates: "We're watching this closely."

Alabama's is stricter on paper. The Alabama Data Breach Notification Act of 2018 sets a 45 day limit and requires written notice to the Attorney General when more than 1,000 people must be notified. It also says the notice to individuals must include "The date, estimated date, or estimated date range of the breach."

The catch is the definition. The Act covers a name combined with, among other things, "A non-truncated Social Security number or tax identification number," and it expressly excludes information that is truncated. A name with the last four digits sits outside that list. Whether the statute applies here turns on details Southern Company has not published, starting with what "other basic account details" means. The same masked number that makes a phishing email convincing can also sit below a legal threshold.

Then there is the SEC. As of October 8, Southern Company's filing index on EDGAR shows no Form 8-K since August 6, 2026. Item 1.05 of that form is due four business days after a company determines a cybersecurity incident is material. Southern Company has not said whether it made that assessment.

For teams that run a customer portal, one question applies whatever the cause turns out to be: which fields can a session retrieve? A field the portal never returns cannot be collected through it. Customer channels deserve the same audit as customer data. On October 6, extortionists reached ASOS shoppers through the retailer's own app.