Southern Company says an unauthorized party accessed limited customer account information through its online customer portal, affecting approximately 400,000 utility accounts across its electric subsidiaries.
The Atlanta-based energy company, which provides electric and natural gas services to more than 9 million customers, said the affected accounts include customers of Georgia Power, Alabama Power and Mississippi Power. About 300,000 of the impacted accounts are associated with Georgia Power, while roughly 100,000 belong to Alabama Power customers. The company did not provide a specific number for Mississippi Power accounts.
Information involved
According to Southern Company’s public notice, the information accessed may include customer names, mailing addresses, telephone numbers, email addresses, the last four digits of Social Security numbers, and basic utility account details.
The company said its investigation has not found evidence that bank account numbers, payment card information or driver’s license numbers were accessed.
Response and customer notifications
Southern Company said it acted to stop the activity after detecting it and has involved law enforcement. The company has not disclosed when the intrusion occurred, how long access may have lasted, or the method used to gain entry to the customer portal.
Affected customers are being notified by mail and email. Southern Company is also offering one year of complimentary credit monitoring services to eligible individuals.
Potential risks
Although the reported data set does not include full payment-card or bank-account details, contact information and partial Social Security numbers can still be useful in targeted phishing, impersonation and account-recovery scams. Customers receiving notifications should independently verify communications from the utility, remain alert for unsolicited requests for account details, and consider monitoring credit reports and utility-account activity.