Loading story…
An unauthorized third party accessed Southern Company’s online customer portal, exposing information associated with approximately 300,000 Georgia Power accounts and 100,000 Alabama Power accounts. Mississippi Power customers were also affected, but their number was not disclosed. Exposed data included customer contact information, the last four digits of Social Security numbers, and other basic account details. The company said bank account, payment card, and driver’s license numbers were not accessed. The intrusion reportedly occurred in September, but the exact incident date and entry method remain undisclosed.
Southern Company said its monitoring systems detected the intrusion, it stopped the unauthorized access, and it notified law enforcement. Affected customers are being notified by mail and email and offered one year of free Equifax credit monitoring. The company also warned customers about fraudulent utility-related communications; the exposed contact and account information could enable more convincing phishing and impersonation attempts.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
Southern Company publicly disclosed the breach and identified Georgia Power, Alabama Power, and Mississippi Power as affected subsidiaries. It did not disclose the exact intrusion date or how the attacker gained access.
An unauthorized third party accessed Southern Company's customer portal, exposing approximately 300,000 Georgia Power accounts and 100,000 Alabama Power accounts; Mississippi Power was also affected, but its count was not disclosed. Accessed information included customer contact details, the last four digits of Social Security numbers, and basic account details, but not bank account, payment card, or driver's license numbers.
Southern Company began notifying affected customers by mail and email and offering one year of free Equifax credit monitoring. It also established an assistance line and warned customers about fraudulent utility-related communications.
Southern Company notified law enforcement about the customer portal breach as part of its incident response.
Southern Company's monitoring systems detected the unauthorized activity, and the company took immediate steps to stop it. The company subsequently reported finding no evidence of ongoing unauthorized access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcesecurityweek.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CenterPoint Energy disclosed in an SEC `8-K` filing that an attacker accessed customer personal information through an internet-facing system after the utility identified a dark-web post offering alleged CenterPoint data. The company said the investigation confirmed unauthorized access affecting an undetermined number of customers, while the threat actor claimed to possess roughly 7.5 million records containing names, contact details, account and billing information, service data, and the last four digits of Social Security numbers. CenterPoint has not confirmed the actor's claimed record count or full dataset, and electricity and natural-gas operations were not disrupted. The Houston-based utility reported the incident to law enforcement and is engaging third-party specialists to establish its scope and issue required notifications. It also faces five proposed federal class-action suits; three allege its guest bill-pay feature exposed personal information when users entered account numbers, though those allegations have not been established in the company's disclosure.
Sep 16, 2026
Capital Economics and People's Energy both suffered data breaches in December 2020 that later surfaced in breach disclosures, exposing large volumes of customer information. Capital Economics, an economic research firm, had about **263,000 customer records** compromised, including names, email addresses, physical addresses, phone numbers, job titles, and employer details. People's Energy, a UK power company, had nearly **7GB of data** exposed, affecting **359,000 unique email addresses** along with names, phone numbers, physical addresses, and dates of birth. The breach also exposed staff email addresses and **`bcrypt` password hashes**, although available reporting said no customer passwords were included in the leaked data.
Jun 29, 2026
AssuranceAmerica Managing General Agency disclosed a cyber intrusion that exposed the personal and insurance-related data of up to **6,998,886 individuals** after an unauthorized third party compromised an employee account and accessed parts of the company’s internal network. The company said the malicious activity occurred on March 16, 2026, was detected on March 17, and resulted in copied data files containing names, contact details, automobile insurance policy and account information, driver and vehicle information, and claims records. For some affected people, the exposed data may also include **driver’s license numbers**, **Social Security numbers**, and **Tax ID numbers**. AssuranceAmerica said it completed its forensic review on June 15 and began notifying affected individuals in July, after initially reporting a smaller impact before later filings raised the total to nearly 7 million. In response, the insurer took affected servers offline, isolated impacted systems, disabled compromised credentials, reset passwords, expanded monitoring and threat detection, increased employee cybersecurity training, notified law enforcement, and offered two years of identity protection and credit monitoring through IDX. The company also warned customers to watch for phishing attempts and identity-related fraud.
Jul 14, 2026