Breach · · 3 min read
Georgia Power and Alabama Power: 400,000 utility accounts accessed
Someone got into Southern Company’s online customer portal and viewed names, contact details and, for some, the last four digits of a Social Security number.
Southern Company, the Atlanta-based parent of Georgia Power, Alabama Power and Mississippi Power, is notifying roughly 400,000 customers that someone got into their utility account information through its online customer portal. If you pay a power bill to one of those companies, here’s what is known and what’s worth doing.
What happened
According to SecurityWeek, about 300,000 of the affected accounts belong to Georgia Power customers and about 100,000 to Alabama Power customers. Mississippi Power is named in the company’s public notice, but no number has been given for its customers.
Southern Company said an unauthorized third party accessed “certain, limited information” and that it stopped the activity once it was detected and brought in law enforcement. Its notice says the information included:
- name and mailing address
- phone number and email address
- for some customers, the last four digits of their Social Security number
- other basic account details
The company says bank account numbers, payment card numbers and driver’s licence numbers were not accessed. It hasn’t said when the access happened or how the attacker got into the portal. Affected customers are being told by mail and email and offered a year of free credit monitoring.
What this means for you
None of this lets someone pay bills or drain an account on its own. The bigger risk is a convincing scam. A caller who knows your name, address, account details and the last four digits of your SSN sounds a lot like your utility. “Pay now or we cut your power today” is one of the oldest utility scams there is, and data like this makes it more believable.
What you can do
- Look for the letter or email, then enrol yourself. If you’re offered credit monitoring, sign up through the instructions in the notice, not through a link in an unexpected message.
- Treat disconnection threats as a red flag. Utilities don’t demand payment by gift card, crypto or a payment app. Hang up and call the number printed on your bill.
- Add a PIN or password to your utility account if your provider offers one, so a caller can’t make changes just by knowing your details.
- Consider a credit freeze. In the U.S., freezes are free at Equifax, Experian and TransUnion and stop new credit being opened in your name.
- Watch for messages built from your details. See how scammers use leaked data.
How Frame helps
Frame keeps a catalog of known breaches. Add the ones you know you were part of to a verified email and Frame shows what each exposed, gives you a short checklist and counts it in your exposure report. Automatic breach lookups aren’t live yet. Frame also guides you through opting out of the people-search sites that publish home addresses and phone numbers, which is the other half of what makes a scam call convincing. We never collect or store the leaked records themselves.
Sources
- SecurityWeek, Georgia Power, Alabama Power Data Breach Hits 400,000 Accounts, October 7, 2026
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.