TL;DR: Southern Company said in early October 2026 that an unauthorized party got into its online customer portal and took account information for about 400,000 customers: roughly 300,000 at Georgia Power and about 100,000 at Alabama Power. Names, addresses, phone numbers, emails, basic account details and the last four digits of Social Security numbers were exposed. Bank and card numbers were not. Affected customers get a year of free Equifax credit monitoring. Expect convincing fake “power bill” calls and texts.
What happened
According to ABC 33/40 and the Atlanta Journal-Constitution, Southern Company detected suspicious activity on the online portal its customers use to view and pay bills. An unauthorized third party had accessed “limited customer account information.” The company says it stopped the access, notified law enforcement and found no evidence of ongoing access.
Georgia Power announced the breach on October 5, 2026. The Georgia Public Service Commission said it is monitoring the situation.
Who is affected
| Utility | Customers affected (approx.) | Total customers (approx.) |
|---|---|---|
| Georgia Power | 300,000 | 2.8 million |
| Alabama Power | 100,000 | 1.6 million |
| Total | 400,000 |
Affected customers are being notified by US mail and email. If you get a notice, it should come from Southern Company or your utility, not from someone calling you about it.
What was exposed, and what wasn’t
Exposed: name, home address, phone number, email address, the last four digits of your Social Security number and basic account details.
Not exposed, per the company: bank account numbers, payment card numbers and driver’s license numbers.
That last-four SSN detail matters more than it sounds. Many call centers, including some banks and phone carriers, still use the last four digits as a security check. Combined with your name, address and phone number, it gives a scammer a believable script.
The real risk: fake power bill calls
Utility customers are already a favorite target for “your power will be cut off in 30 minutes unless you pay” scams. Now the callers may know your account details and the last four of your SSN. Expect:
- calls or texts saying your payment failed and service will be disconnected today;
- requests to pay by gift card, Zelle, Cash App or crypto;
- fake “breach compensation” or “refund” offers asking you to confirm your details;
- phishing emails pretending to be the breach notice itself.
Georgia Power and Alabama Power do not take payment by gift card. If you get a threatening call, hang up and call the number on your paper bill or the official website. We explain how these calls work in imposter scam calls and caller ID spoofing.
What to do now
- Enroll in the free Equifax monitoring if you get a notice. Use the code in the letter, not a link from an unexpected text.
- Change your portal password and any other account that used the same one. Our leaked password guide explains why reuse is the real danger.
- Freeze your credit at Equifax, Experian and TransUnion. It is free and stops new accounts being opened in your name, see how to freeze your credit.
- Ask your phone carrier and bank to stop using SSN digits alone as verification, and add a PIN or passphrase. For your phone, add a port-out PIN.
- Watch for breach-themed phishing. See how to tell a real breach notice from a fake one.
How exposed are you already?
A utility portal breach is rarely the first time your details have leaked. Your email may already be in several older breaches, which makes phishing easier to tailor. Run a free email exposure check to see where it has turned up.
Frequently Asked Questions
How many customers were affected by the Southern Company breach?
About 400,000 in total: roughly 300,000 Georgia Power customers and about 100,000 Alabama Power customers, according to the company and local reports.
Was my full Social Security number stolen?
The company says only the last four digits were exposed, along with name, address, phone, email and basic account details. Bank and card numbers were not.
Is there free credit monitoring?
Yes. Affected customers are offered one year of free credit monitoring through Equifax. Enroll using the details in your official notice.
Someone called saying my power will be shut off today. Is it real?
Treat it as a scam. Hang up and call the number on your bill or the utility’s official website. Utilities do not demand gift cards or crypto.
Sources
- ABC 33/40: 100,000 Alabama Power customers affected in Southern Company data breach
- Atlanta Journal-Constitution: Georgia Power data breach (Oct 2026)
- SecurityWeek: Georgia Power, Alabama Power data breach hits 400,000 accounts
- FTC: Credit freezes and fraud alerts