About 300,000 of Georgia Power’s 2.8 million customers had personal details exposed after hackers got into the utility’s online customer portal, the company said October 5. The exposed records include names, mailing addresses, phone numbers, email addresses and the last four digits of Social Security numbers. Roughly 100,000 customers of sister utility Alabama Power were affected too, and Mississippi Power customers are named in the notice. Georgia Power is offering affected customers one year of free credit monitoring through Equifax.
Affiliate links — we may earn a commission.
What the Southern Company notice lists
Georgia Power, Alabama Power and Mississippi Power are all owned by Southern Company, and the notice covers customers of all three. The company says it found the activity through its ongoing monitoring, took immediate steps to stop it and engaged law enforcement. Georgia Power spokesperson Jacob Hawkins told the Atlanta Journal-Constitution, “We understand the trust our customers place in us and remain committed to protecting their information.” The utilities say bank account numbers, payment card numbers and driver’s license numbers were not accessed.
Customers whose information was accessed are being notified by email and by mail, and the notice offers each one year of free credit monitoring through Equifax. Enrollment instructions are in that letter or email, because the web notice lists no enrollment code or deadline. An assistance line, 1-800-900-6021, runs weekdays from 6 a.m. to 6 p.m. Central. The open question for each household is what to do once the monitoring year ends, since names, addresses, phone numbers and emails are the kind of detail data brokers and people-search sites list, and Incogni sends removal requests to those brokers for you and keeps re-sending them.
Georgia Power’s roughly 300,000 notified accounts are about 11 percent of its 2.8 million customers. Alabama Power’s roughly 100,000 are about 6 percent of its 1.6 million. The notice gives no count for Mississippi Power. SecurityWeek reports that the company puts the total across the utilities at about 400,000 customers.
A portal intrusion with key details missing
Southern Company has not said when the intrusion happened or how the attacker got into the portal. The Atlanta Journal-Constitution reported that it learned of the breach from an affected customer before Georgia Power made it public on Monday, October 5. According to the newspaper, Georgia law requires companies to notify affected customers “in the most expedient time possible and without unreasonable delay,” sets no fixed deadline and does not require a company to tell a state agency.
Jason Shaw, chairman of the Georgia Public Service Commission, which regulates the utility, told the newspaper, “The first thing I asked was, with the affected customers, what are they offering them to help.” Georgia Power spoke with the commission on Friday, before the public announcement, and the commission says it is asking for continual updates. Liz Coyle, executive director of the consumer group Georgia Watch, told the newspaper, “The most important thing at a time like this is transparency.” She argued the utility should have alerted all customers the Friday before the announcement.
Impostor calls after a utility data breach
The utilities’ own notice points to the main follow-on risk: callers posing as the utility. It tells customers to be cautious of unexpected contacts claiming to be Alabama Power representatives and to verify them with the phone number on the bill or the official website. It also says, “We will never threaten immediate disconnection or demand payment over the phone.” A caller who already has a customer’s name, address and last four Social Security digits can sound convincing, and the warning is aimed at that.
The mix of fields in the notice explains why the impostor risk outweighs the risk of direct theft. The exposed records pair a name, mailing address, phone number and email with the last four digits of a Social Security number, while the utilities say bank account, payment card and driver’s license numbers were not accessed. That is enough for a caller to recite details that sound like an account file, but it leaves out the numbers a thief would need to charge a card or reach a bank account, which is why the verification advice in the notice centers on the phone number printed on the bill.
Setting up the Equifax year and a credit freeze
The FTC says a credit freeze is free, does not affect a credit score and stays in place until the person lifts it, and it has to be requested at all three bureaus: Equifax, Experian and TransUnion. A fraud alert, by contrast, needs one bureau, which must tell the other two, and an initial alert lasts one year. The notice also suggests a security freeze, along with free annual credit reports at annualcreditreport.com or (877) 322-8228.
Customers who think their Social Security number has been misused can report it at IdentityTheft.gov, the FTC’s step-by-step reporting site. The notice also asks customers not to reuse passwords across accounts, to change any duplicates, and to review accounts regularly for unusual activity.
Three facts remain unreleased: when the intruder was in the portal, how it got in, and how many Mississippi Power customers were affected. Chairman Shaw’s question, what the company is offering affected customers, has a one-year answer so far. Whether the updates the Public Service Commission has asked for fill in the rest is the next marker.
One year of monitoring, contact details left behind
A utility account record held a name, mailing address, phone number and email next to the last four Social Security digits, and the Equifax offer runs one year. Incogni asks data brokers and people-search sites to remove your personal information, sends the removal requests on your behalf and keeps re-sending them, and less personal data on broker lists can mean fewer scam calls, texts and emails.
Ask people-search sites to remove your address and phone number with Incogni →
This article was prepared with AI assistance from cited public sources and reviewed before publication.
