Southern Company (Georgia Power, Alabama Power, Mississippi Power) data breach

What happened

Southern Company said on October 5, 2026 that an unauthorized third party accessed limited account information for about 400,000 customers through its online customer portal. About 300,000 of the accounts belong to Georgia Power customers and about 100,000 to Alabama Power; Mississippi Power is also named, without a figure. The data includes names, mailing addresses, phone numbers, email addresses, or the last four digits of Social Security numbers (or business tax IDs), plus basic account details. The company says full Social Security numbers, bank account numbers, card numbers and driver's license numbers were not involved. Affected customers are being notified by mail and email and offered a year of free credit monitoring.

What should I do?

1. Enroll in the free one-year credit monitoring offered in your notice.
2. Be wary of calls, texts or emails threatening to cut off your power unless you pay right away; hang up and call the number on your bill.
3. Change your utility portal password and turn on any extra login protection, and change it anywhere else you reused it.
4. Expect phishing that uses your real name, address and the last four digits of your SSN to sound legitimate.

More data breaches in the United States →

Check the other services you use →