October 12-13, 2026: Georgia Power Company (and sister utilities Alabama Power and Mississippi Power, all part of Southern Company) disclosed a breach affecting approximately 400,000 customers (300K Georgia; 100K Alabama/Mississippi each). Names, addresses, phone numbers, email addresses, and last four digits of Social Security numbers were exposed via unauthorized access to the online customer portal. Canonical: georgia-power-breach2026. Source: SecurityWeek.
What happened
Sometime before early October 2026 (exact window undisclosed), unauthorized parties gained access to the online customer portal used by Georgia Power, Alabama Power, and Mississippi Power. The portal serves customers in three states and allows them to manage billing, make payments, report outages, and access account information. The companies detected the unauthorized access, immediately shut down the portal, and launched a forensic investigation. By October 12-13, they began notifying affected customers via mail and email and published statements on their websites. The specific attack vector has not been disclosed.
Technical analysis
The customer portal is a shared system backend serving three utility companies across three states. Exposed data: customer names, service addresses, phone numbers, email addresses, and last four digits of Social Security numbers (SSN4). NOT exposed: full Social Security numbers, payment card numbers (customers enter cards at time of payment; cards are not stored in the portal), confirmed password compromise or account credentials.
The separation of payment processing from the customer portal was a partial mitigator. Attackers cannot directly charge victims' utility bills. However, SSN4 combined with name, address, and phone is highly valuable for social engineering, identity theft, and account takeover. In the utility industry, account compromise can be particularly damaging — attackers can redirect bills, create unauthorized accounts, cause service interruptions, or lock legitimate account holders out.
The portal being taken offline immediately after discovery limited the exposure window, but the length of unauthorized access prior to detection remains unknown.
Impact
Scope: Approximately 400,000 customers across three utilities: 300,000 in Georgia, 100,000 in Alabama, 100,000 in Mississippi. These are large figures — Georgia Power alone serves millions of customers in the state, making this a major regional breach affecting about 10-15% of Georgia Power's customer base.
Risks to victims: Social engineering (attackers use SSN4, name, and address to call utility customer service, banks, or government agencies and impersonate victims). Phishing (unsolicited emails claiming to be from Southern Company utilities, asking users to "verify accounts" or claim a refund). Email account takeover (attackers use the breached email to reset passwords on other accounts). Utility account manipulation (attackers can change service addresses, redirect bills, or create new accounts in victims' names). Identity theft (SSN4 is useful for credit applications and fraud). Credit fraud (opening new accounts, taking out loans).
What to do
- Watch for phishing — ignore unsolicited emails or calls claiming to be from Georgia Power, Alabama Power, or Mississippi Power. Go to the official website or call the number on your bill to verify any company communication.
- Monitor your utility account — log in regularly to check billing status, service address, phone number, and account activity. Report any unauthorized changes immediately.
- Monitor credit reports — check for fraudulent accounts using free services like Equifax, Experian, or TransUnion. You're entitled to one free annual report from each bureau.
- Consider a credit freeze — lock your credit with major bureaus if concerned about identity theft. This prevents criminals from opening new accounts in your name.
- Use a unique password — when the portal is restored, set a strong, unique password that is not reused from other sites.
- Enable MFA — use multi-factor authentication on your utility account if available when the portal restores.
- Be skeptical of customer-service calls — hang up and call the official utility number from your bill to verify. Social engineering via phone is common after breaches.
Related reading
See utility account takeover prevention.
Sources
SecurityWeek (Oct 13, 2026) • Southern Company official statements