Southern Company says an unauthorized party got into its online customer portal and viewed account information for about 400,000 customers of its Georgia Power and Alabama Power subsidiaries, SecurityWeek reported Wednesday. Mississippi Power customers were also affected, though the company gave no number for them.

What Happened

The Atlanta-based utility holding company disclosed the incident in statements to the media and a notice on its website. About 300,000 Georgia Power accounts and about 100,000 Alabama Power accounts were involved; Alabama Power has about 1.6 million accounts in total.

The information exposed includes customers' names, mailing addresses, phone numbers, email addresses, the last four digits of their Social Security numbers and other basic account details. Southern Company said bank account numbers, payment card numbers and driver's license numbers were not accessed.

RelatedCybersecurity Incident at BAE Systems Halts Notices From U.S. Bankruptcy Courts

The company said it moved immediately to stop the activity once it was detected and has brought in law enforcement. It has not said how the intruder gained access to the portal, when the access began or was discovered, or who was responsible. Affected customers are being notified by mail and email and offered one year of free credit monitoring.

Southern Company serves more than 9 million customers across its three electric utilities in Georgia, Alabama and Mississippi.

Why It Matters

The data taken is not enough on its own to empty a bank account, but it is well suited to fraud aimed at utility customers. Scammers posing as power companies routinely call or text customers threatening disconnection unless an overdue bill is paid immediately. A caller who can recite a customer's name, address, account details and the last four digits of a Social Security number is far more convincing, and partial Social Security numbers are often used as a verification question.

The incident also adds to scrutiny of utilities' digital security. Power companies are treated as critical infrastructure, and while this breach appears confined to a customer-facing website rather than systems that run the grid, customer portals hold identity and contact data for millions of households. The company has given no indication that operational systems were affected.

Context

Utility customer portals handle account management, bill payment and service requests, so they combine personal contact details with account records in one place. Southern Company's three electric subsidiaries make it one of the largest U.S. utility holding companies by customer count, which is why a breach touching only part of its customer base still runs to hundreds of thousands of accounts.

Breach notices that withhold the entry method are common in the first days after disclosure, but they leave customers unable to judge whether their own login credentials or security questions need to change.

What to Watch

Notification letters and emails are going out now, and their wording may say more about the timeline than the initial statements did. Other open questions are how the portal was accessed, whether customers' portal passwords were affected, how many Mississippi Power accounts were involved and whether any group claims responsibility. State regulators and attorneys general in the three states may also seek details.