Georgia Power, Alabama Power Data Breach Hits 400,000 Accounts
Southern Company utility breach exposes 400K customer accounts including names, addresses, and SSN last 4 digits.
Southern Company notified approximately 400,000 customers that an unauthorized third party accessed their utility account information through the company's online customer portal. The breach affected roughly 300,000 Georgia Power accounts and 100,000 Alabama Power accounts, with exposed data including customer names, mailing addresses, phone numbers, emails, and last 4 digits of Social Security Numbers. The company reports that attackers did not access bank account numbers, payment card numbers, or driver's license numbers, and affected customers are being offered one year of free credit monitoring.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Southern Company?
Get an email when a new story names Southern Company, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAn unauthorized third party gained access to Southern Company's online customer portal, compromising personal data for approximately 400,000 customers across Georgia Power and Alabama Power. The incident highlights critical weaknesses in how access to customer-facing web portals is controlled, monitored, and restricted. Sensitive partial identity data — including partial Social Security Numbers — was exposed, creating real risk for phishing, social engineering, and identity theft downstream. The fact that attackers accessed the portal without detection until after the breach underscores the need for robust session monitoring and anomalous access alerting. Offering one year of credit monitoring is a reactive measure; proactive controls should have prevented unauthorized access in the first place.
What helps against this
How we list vendors- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.