On October 5, 2026, Southern Company, the parent company of Alabama Power and Georgia Power, announced that an unauthorized third party had accessed its online customer portal. The intrusion exposed personal information tied to about 400,000 customer accounts, including names, contact details, and partial Social Security numbers. If you get your electricity from Alabama Power or Georgia Power, you may be affected.
Key Takeaways
- About 400,000 Southern Company customer accounts were affected, including roughly 100,000 with Alabama Power and 300,000 with Georgia Power.
- Hackers accessed names, addresses, email addresses, phone numbers, and the last four Social Security digits, but not full Social Security numbers, bank accounts, or card numbers.
- Watch for phishing, consider a free credit freeze, and talk to an attorney before you enroll in the offered credit monitoring.
The unauthorized access happened in September. About 100,000 affected accounts belong to Alabama Power customers, and about 300,000 belong to Georgia Power customers. Some business accounts were also affected. The company is notifying affected customers by email and U.S. mail and offering one year of free credit monitoring.
At Cory Watson Attorneys, we have spent 44 years helping people hold large companies accountable when they fail to protect them. Below, we explain what happened, why it matters, and what to do next.
What Happened in the Southern Company Data Breach?
According to the company, someone accessed the portal customers use to pay bills and manage accounts without permission. Southern Company says it stopped the activity, called law enforcement, and has found no sign the intruder is still inside. The company has not said who was behind it.
Alabama Power serves about 1.6 million customers, so roughly 1 in 16 of its customers was affected.
What Information Did the Hackers See?
The notices list names, home addresses, email addresses, phone numbers, and the last four digits of Social Security numbers or business tax ID numbers. The company says it did not expose full Social Security numbers, bank account numbers, card numbers, or driver's license numbers.
Why Can a "Partial" Breach Still Hurt You?
Names, phone numbers, email addresses, and partial Social Security numbers can make a fake message look real. That gives scammers something to work with, even without full financial data.
Fake messages like these are called phishing: emails, texts, or calls designed to get you to share personal information or money. The FBI's 2024 Internet Crime Report logged 193,407 phishing and spoofing complaints, more than any other crime type. Total reported losses from all internet crime hit a record $16.6 billion.
What Scams Should You Watch For?
After the Southern Company data breach, Alabama Power and Georgia Power warned customers about fraudulent calls, texts, and websites pretending to be the utility. If a message looks suspicious, do not click any links or open any attachments.
Identity theft is a real risk, too. The Federal Trade Commission's 2024 Consumer Sentinel Network Data Book counted more than 1.1 million identity theft reports in a single year.
What Should You Do If You Got a Notice?
Read the notice carefully. To confirm anything, type alabamapower.com or georgiapower.com into your browser, or call the number on your bill. Never use links or numbers from an unexpected message.
Next, change your portal password and the password for any account that shares it, and turn on two-step login.
Then protect your credit. The Federal Trade Commission's guide to credit freezes and fraud alerts explains that both are free. A freeze blocks new accounts in your name and does not affect your credit score, but you must contact Equifax, Experian, and TransUnion separately. A fraud alert needs just one request to any of the three bureaus and lasts one year.
Before you enroll in the offered credit monitoring, talk to a data breach attorney. Save your notice, any suspicious messages, and notes on the time or money you spend fixing problems.
Do Companies Have to Tell You About a Breach?
Yes. Alabama and Georgia both have laws that generally require companies to tell residents when a breach affects their sensitive personal information. Alabama was the last state to pass one, in 2018, according to the Alabama Attorney General's office.
Timing can matter. The Southern Company data breach happened in September, but customers heard about it in October. A lawyer can look into whether that gap was reasonable.
Could You Have a Legal Claim After the Southern Company Data Breach?
Companies that collect your personal information are expected to take reasonable steps to keep it safe. When they fall short, customers may be able to seek payment for out-of-pocket costs, time spent fixing problems, and the stress that follows fraud.
Our data breach lawyers can review your notice and explain your options. That may include a class action, one lawsuit where many people with the same harm join together. Every case is different, and no result is guaranteed.
Why Do Breach Victims Call Us?
Over 44 years, our firm has recovered more than $4 billion for clients, and our attorneys represent data breach victims across the country. Whether your account is with Alabama Power or Georgia Power, we can review your notice and explain your options.
Case reviews are free. You can learn more about us and the people behind our work. Past results do not guarantee future outcomes.
Questions We're Hearing From Customers
How do I know if I was part of the Southern Company data breach?
Notices are going out by email and U.S. mail. If you are unsure, call the number on your bill.
Should I sign up for the free credit monitoring?
Talk to a data breach attorney before you enroll. Enrollment terms can include conditions that matter if you later pursue a claim, so have a lawyer review them first.
Will a credit freeze hurt my credit score?
No. A freeze does not affect your score, and lifting it is free.
What should I do if someone contacts me claiming to be my utility?
Do not share any information. Hang up, then call the number on your bill or visit your utility's official website.
Does it cost anything to talk to a lawyer about this?
Our case reviews are free, and there is no obligation to move forward.
Got a Breach Notice? Let's Talk Before You Sign Anything
If you received a notice about the Southern Company data breach, reach out for a free review of your options. Contact us today at (877) 562-0000.