Southern Company’s customer notice says an unauthorized party got into limited information on some utility accounts. The accounts sit with Georgia Power, Alabama Power, and Mississippi Power. The notice, which local news tied to statements this week, lists contact details and, for some people, the last four digits of a Social Security number. It says bank account numbers, payment card numbers, and driver’s license numbers were not in what was accessed. [1]
Too long; didn’t read?
- The company’s notice says the access was discovered through its own monitoring. It does not give the day the party first got in. [1]
- WSB-TV reported a company statement that about 400,000 Southern Company accounts were involved, and that 300,000 of those were Georgia Power customers. [2]
- The Atlanta Journal-Constitution reported on October 6 that Georgia Power had about 2.8 million customers and that roughly another 100,000 accounts belonged to the Alabama and Mississippi utilities. [3]
- Affected people are told by email and by postal mail. The notice offers one year of Equifax credit monitoring. A freeze at the three bureaus is free and does not change a credit score. [1] [4]
What the notice says was opened
The notice says monitoring recently found that an unauthorized third party accessed certain information about the utility accounts of a limited group of customers. The fields it names are a name, mailing address, phone number, email, or the last four digits of a Social Security number, plus what it calls other basic account details. The word “or” is doing work. The notice does not say every account lost every one of those fields. [1]
It is explicit about what it says was left alone: bank account numbers, payment card numbers, and driver’s license numbers. [1] WSB-TV, in a story timestamped October 5, 2026, reported a Georgia Power statement in plainer bulk: the company said an unauthorized party had reached “certain, limited information about the accounts of approximately 400K customers,” and the station said that set included names, addresses, phone numbers, emails, and the last four digits of Social Security numbers. [2] Read the notice and the station together. The station gives the headcount. The notice gives the careful list.
The Journal-Constitution’s October 6 story said Georgia Power was telling roughly 300,000 of its 2.8 million customers, and that about another 100,000 customers of the sister utilities in Alabama and Mississippi were affected. It said those customers were being notified by email and by the U.S. Postal Service, and that the company described the portal access as having happened last week. The notice itself still says “recently,” and it says the review so far has not found evidence that the access is continuing. [1] [3]
What the company says it did
The notice says the company took steps when it found the access, told law enforcement, and is still investigating. Customers it decides were affected get a letter, an email, or both, using the address and email already on the account. The offer inside that letter is one year of credit monitoring through Equifax. The notice also points people at the free annual credit reports at annualcreditreport.com and at a security freeze. [1]
WSB-TV quoted the company a step further than the notice’s “review to date” line. In that story Georgia Power said it had conducted a thorough investigation and had not identified evidence of ongoing unauthorized access. [2] Those are the company’s words about its own systems. They are not an outside audit published for anyone to read.
What you can do with a last-four and a phone number
Four digits of a Social Security number are not the full number. They are still enough for a stranger to sound as if they already know the account, especially with the name, the service address, the phone, and the email beside them. The notice tells customers the company will not threaten an immediate disconnection or demand payment over the phone. If a call does that, the notice says to hang up and use the number on the bill or on the utility’s own site. The copy of the notice reviewed here lists 1-800-900-6021 as the Alabama Power assistance line, weekdays, 6 a.m. to 6 p.m. Central. A Georgia letter may name a different line. Use the number printed for your own utility. [1]
The Federal Trade Commission says a credit freeze is free, lasts until you lift it, and does not change your credit score. While it is on, a new credit account is not supposed to be opened in your name, including by you, until you lift it at the bureau a lender will check. You place it at Equifax, Experian, and TransUnion. The company’s year of Equifax monitoring is a separate offer that arrives in the letter. A freeze does not depend on enrolling in that offer. [4]
Change a password that this utility shared with any other account. The notice asks for that in general terms. The email and the phone number in the file can be used later for a fake past-due bill. That reuse does not need the portal to stay open.
