Georgia Power told roughly 300,000 of its 2.8 million customers Monday that an unauthorized party accessed its online portal and copied limited account data, according to the Atlanta Journal-Constitution, which reviewed the company’s customer notices. Sister utilities Alabama Power and Mississippi Power, both owned by Southern Company, reported about 100,000 additional accounts touched in the same incident.
What attackers took—and what they did not
Georgia Power said the intrusion did not expose full payment card numbers or bank account credentials stored for autopay. The utility described the haul as contact and service-location information—names, addresses, phone numbers, and email addresses tied to portal profiles—exactly the fields criminals need to craft convincing phishing lures.
Customers began receiving email and postal notices over the weekend. If you have not heard from the utility but hold an online Georgia Power profile, log in only through the company’s official site or mobile app rather than links in unexpected messages.
Steps to take this week
Freeze or fraud-alert your credit files at Equifax, Experian, and TransUnion if you want to block new-account openings. Freezes are stronger than alerts and do not affect your score. Monitor existing bank and card accounts for small test charges.
Expect follow-on scams: callers claiming to be “Georgia Power security” asking for portal passwords, Social Security numbers, or gift-card payments to “clear a fraudulent login.” Real utilities do not demand payment in gift cards. Hang up and dial the number printed on your paper bill.
The IRS used October’s Cybersecurity Awareness Month push to remind taxpayers that government agencies will not threaten immediate arrest by text. The same discipline applies to utility impersonation—verify through a channel you initiate.
Why portal breaches keep happening
Electric utilities consolidated billing, outage maps, and payment tools into single sign-on portals over the past decade. That convenience concentrates identity data. Security teams must assume portal credentials will be targeted during shopping seasons when consumers click more promotional links.
Southern Company has not publicly attributed the breach to a specific threat group. Customers in all three states should treat any message referencing the incident as untrusted until confirmed through official portals.
Reporting and recovery
If you shared information with a scammer after the breach notice, file a report at IdentityTheft.gov for a recovery checklist, and notify your bank the same day. Document portal screenshots showing unauthorized profile changes; they help investigators even when money was not stolen directly.
Georgia Power said it is reinforcing portal monitoring. For households, the durable defense is skeptical inbox hygiene paired with credit freezes—especially as Prime Big Deal Days traffic pushes more retail phishing into the same week as this utility disclosure.
Overlap with shopping-season phishing
Security researchers tracking October fraud patterns say utility-themed smishing often follows breach disclosures within 72 hours. Messages may include your street address pulled from the leaked database. Delete texts that embed login links even if the greeting uses your name.
Alabama and Mississippi customers should use each operating company's branded app store listing—not a link from email—to download billing tools. Southern Company operates a shared IT backbone; credentials reused across state portals should be changed everywhere, not just in Georgia.
Small businesses with accounts tied to home addresses may appear in the dataset even if the meter serves a commercial kitchen. Update contact emails if staff turnover left old inboxes forwarding mail.
Credit monitoring offers
Utilities sometimes partner with identity vendors after incidents. Read whether enrollment auto-renews after a free year and whether the vendor can sell aggregated marketing data. A freeze at the three major bureaus remains the strongest free tool.
Law-enforcement agencies encourage victims of follow-on fraud to keep call recordings and forwarded emails; those artifacts help telecom carriers block spoofed caller IDs used in utility scams.