If you pay a power bill online in Georgia or Alabama, check your email and your mailbox for a notice. On October 5, 2026, Southern Company said an unauthorized person got into its online customer portal. The company is now notifying the people affected.
This one is easier to read than most. Southern Company named the data that was exposed and gave a count. It has not said how the attacker got in. Here's what's known, what isn't, and what to do.
What the company has confirmed
About 400,000 customer accounts were affected. Roughly 300,000 are Georgia Power accounts. About 100,000 more are at sister utilities, including Alabama Power. These are accounts, not people, so the number of individuals could differ.
Exposed: names, addresses, phone numbers, email addresses, basic account details, and the last four digits of Social Security numbers.
Not exposed, according to the company: bank account numbers, payment card numbers, and driver's license numbers.
Southern Company says it stopped the unauthorized access and called in law enforcement. It also says its investigation found no sign of ongoing access. Affected customers are being told by email and by U.S. mail, and the company set up a customer service line. Everyone affected is offered one year of free credit monitoring through Equifax.
What still isn't clear
The company describes "suspicious activity" on its customer portal. It hasn't said how the attacker got in. That matters. Stolen passwords from other breaches would point to a different problem than a flaw in the portal itself. Until the company says, assume neither.
It also hasn't said exactly when the access happened. Georgia Power says its own monitoring caught the activity. The CenterPoint Energy breach went the other way for weeks: the company confirmed almost nothing about what was taken, until a state filing finally gave a number. Here, the gap is the "how."
Why four digits is still a problem
The last four digits of your Social Security number don't give anyone your full number. But many banks and phone companies use those four digits as a quick ID check. Put them next to your name, address, phone number, and email, and a stranger can sound a lot like you on a call. That's the same pattern behind SIM swap attacks.
It also makes a scam call more believable. A caller who knows your address, your power company, and part of your SSN can sound official. Our guide to the scam call playbook explains why that's not proof of anything.
- Check the notice before you click anything. Criminals copy breach emails. Go to your power company's website by typing the address yourself, or call the number printed on your bill.
- Take the free Equifax monitoring. It costs nothing. Just know it tells you after something happens. It doesn't stop it. Here's what monitoring can and can't do.
- Freeze your credit. That's the step that blocks new accounts in your name. It's free at Equifax, Experian, and TransUnion. Here's how.
- Change your portal password, and anywhere you reused it. The company hasn't said whether passwords played a part, so don't wait to find out. Why one reused password is the real risk.
- Doubt any call or text about your power bill. Hang up and call the number on your bill. Real utilities don't need you to act in the next ten minutes.
If you got a notice letter, keep it. It tells you exactly what was taken, and it may be your proof if a settlement follows, like the Americold payout. This breach is still new, and the details could change.
Also in the news
Updated October 20, 2026. Four more breaches from the past two weeks are worth knowing about.
ASOS, the UK fashion retailer. On October 6, shoppers got a push notification from the ASOS app that wasn't from ASOS. It said the attackers had "fully compromised" company data and told ASOS to "engage with us, or we will leak it." ASOS now says someone got into an employee account by impersonating a trusted contact and getting the employee's login details. ASOS says full names and contact details were exposed, but not payment card details or account passwords. It hasn't said how many customers were affected. A group calling itself Xuanye claims it stole customer data, and has not shown proof. By ASOS's own account, this one started with a trick played on a person, the same approach as the Revolut breach.
More Rewards, the Canadian grocery loyalty program. The parent company, Pattison Food Group, runs Save-On-Foods, Buy-Low Foods, PriceSmart Foods, and Nesters. It found unusual activity on a server, and confirmed on October 16 that More Rewards customer information was accessed. That's names and, if you gave them, addresses, phone numbers, emails, and birth dates. The company says passwords, credit card data, and purchase history weren't accessed. It hasn't said how many people or how the attacker got in. A birth date can't be changed, so this is one to take seriously if you're a member.
CenterPoint Energy, now with a number. After weeks with no count, a listing on the Texas Attorney General's website put the total at 1,062,060 Texans. It lists names, addresses, "Social Security information," and driver's license numbers. As of those reports, letters hadn't gone out yet. The count is for Texas only, and CenterPoint also serves Indiana, Minnesota, and Ohio. Our guide to the CenterPoint and Florida DMV breaches has the details.
Oracle Health (formerly Cerner), a hospital records breach from 2025. State filings now put it at about 20 million people, including nearly 3 million Texans. That figure comes from a Bloomberg report on a Texas filing, and Oracle hasn't publicly confirmed it. Oracle's earlier notice says names, Social Security numbers, and medical record details were involved. Researchers say the attacker used stolen login credentials on an old server. If a hospital that used Cerner software has told you your records were involved, our guide to medical identity theft covers the steps.
We also cover a separate breach of a Pentagon records system in its own guide.
Is your info in a breach like this one?
Our free scan shows which known breaches contain your email and whether identity data was exposed alongside it.
Run the Free Breach Scan →