2026 Southern Company — customer portal access; ~400k GA/AL Power accounts
Data compromised
Names, addresses, phone numbers, email addresses, last four digits of SSNs (or business tax IDs), other basic account details; company states full SSNs, bank accounts, payment cards, and driver’s licenses were not included. ~300k Georgia Power + ~100k Alabama Power
Technical writeup
Verified Southern Company / Georgia Power / Alabama Power customer notices reported Oct 5, 2026. An unauthorized third party accessed limited account information via the online customer portal; activity was stopped and law enforcement notified with no evidence of ongoing access. About 400,000 accounts affected (~300,000 Georgia Power; ~100,000 Alabama Power). Exposed fields include name, address, phone, email, SSN last-four (or business TIN), and basic account details — not full SSN, bank, payment card, or driver’s license numbers. Credit monitoring offered. companyConfirmed true; recordsAffected 400000.
Root cause
Unauthorized third party accessed the Southern Company online customer portal (company statements; initial vector unpublished)