Southern Company's customer portal breach exposed names, addresses, phone numbers, emails, and the last four digits of Social Security numbers or business tax IDs for about 400,000 utility customers, roughly 100,000 of them Alabama Power accounts. Full SSNs, bank details, and card numbers were not taken. Change your portal password, freeze your credit, and claim the free monitoring.
What Was Exposed
Taken: names, mailing addresses, phone numbers, email addresses, the last four digits of Social Security numbers or business tax IDs, and basic account details. Not taken: full Social Security numbers, bank account numbers, credit or debit card numbers, driver's license numbers. How: an unauthorized third party accessed Southern Company's online customer portal; the activity was detected and stopped, and the company says it has no evidence of ongoing unauthorized access. Remedy offered: one year of free credit monitoring through Equifax for affected customers.
Who Is Affected
Southern Company is the Atlanta-based energy holding company behind Alabama Power, Georgia Power, and Mississippi Power, serving millions of electric and natural gas customers across the Southeast. The portal intrusion disclosed in early October 2026 touched roughly 400,000 electric customers, with about 100,000 Alabama Power accounts among them. If you have ever registered for online bill pay or account management with a Southern Company subsidiary, you are in the population that should act — whether or not a letter has reached you yet. Notification letters and emails typically lag disclosure by weeks.
Step 1: Change Your Utility Portal Password and Add 2FA
Go to your utility's website directly — type the address yourself rather than following a link in an email — and change the password on your online account. If that password is used anywhere else, change it there too, starting with your email. Turn on two-factor authentication if your utility offers it, and review any saved payment methods and stored autopay settings while you are in the account.
Step 2: Treat the Last Four Digits as Real Exposure
“Only the last four of your SSN” sounds reassuring and is not. Those four digits are precisely what call-center agents, utilities, mobile carriers, and some banks use to confirm identity over the phone. Combined with your name, address, and account number, they let a caller impersonate you convincingly — the basis of account takeover and SIM-swap fraud. Add a PIN or passphrase to your utility and mobile carrier accounts so verification does not rest on data that is now circulating.
Step 3: Freeze Your Credit at All Three Bureaus
A credit freeze is free, reversible, and blocks new accounts being opened in your name — stronger protection than monitoring, which only reports damage after it happens. Freeze at Equifax, Experian, and TransUnion, and consider the secondary bureaus (Innovis, NCTUE) as well. NCTUE matters here in particular: it is the utility and telecom exchange that power and phone companies check when someone applies for new service in your name.
Is your data already out there?
Leaked data ends up on broker sites and in scammers' hands. Run a free 60-second scan to see your exposure — then let us remove it.
Run a free scan★★★★★ 4.8/5 · Trusted by thousands of families
Step 4: Enroll in the Free Equifax Monitoring Anyway
Southern Company is offering one year of credit monitoring through Equifax to affected customers. Enroll — it costs nothing and creates a record of your response — but understand its limits: it watches credit files, not utility accounts, and it expires in twelve months while leaked data does not. Enrolling never waives your legal rights, including the right to join any class action that follows.
Step 5: Expect Utility-Themed Scams
Breached utility customer lists fuel a specific and effective scam: a caller or text claims your power is about to be disconnected for non-payment and demands immediate payment by card, app, or gift card. Alabama regulators issued a public warning about online bill-pay risks in the days after this disclosure for exactly that reason.
- No utility demands instant payment to prevent same-day disconnection over the phone. Hang up and call the number on your paper bill.
- Never pay a utility bill with a gift card, wire transfer, or peer-to-peer app at a caller's request.
- Distrust emails about “account verification” after a breach — attackers know you are expecting breach-related mail, and that is the window they exploit.
- Watch for fake settlement notices promising breach compensation in exchange for your bank details.
Verify Before You Pay
If anyone contacts you about your power account, end the contact and dial the customer service number printed on your bill or statement. Legitimate utilities will always let you call back.
Step 6: Shrink What a Scammer Can Confirm About You
Social-engineering calls work because the caller can recite details that feel private. Much of that material is not from the breach at all — it is published by data brokers and people-search sites, which sell your address history, phone numbers, relatives, and property records to anyone who asks. Removing those listings makes a breached last-four far less useful to the person holding it.
PrivacyOn removes your personal information from 100+ data broker and people-search sites, monitors for relisting 24/7 and refiles automatically when your data reappears, and includes dark web monitoring that flags your details in new dumps. One plan covers up to 5 family members from $8.33/month.
See What Is Already Public
Run a free PrivacyOn scan to find which brokers publish your address, phone number, and household details right now — the context that turns a utility breach into a convincing scam call — then let PrivacyOn take them down.
Frequently Asked Questions
How many people were affected by the Southern Company data breach?
About 400,000 electric customers across Southern Company's Southeast service territory, including roughly 100,000 Alabama Power accounts. Affected customers are being offered a year of free credit monitoring through Equifax.
Was my full Social Security number exposed?
No. Southern Company says full Social Security numbers, bank account details, credit and debit card numbers, and driver's license numbers were not involved. What was taken includes names, addresses, phone numbers, emails, and the last four digits of Social Security numbers or business tax IDs.
Is the last four digits of my SSN actually dangerous?
Yes, more than people assume. Those digits are a standard identity check for utilities, carriers, and some financial call centers. Paired with your name, address, and account number, they enable account takeover and SIM-swap attempts, which is why adding an account PIN and freezing your credit matters here.
Should I freeze my credit after the Southern Company breach?
Yes. Freezes are free at Equifax, Experian, and TransUnion, block new-account fraud outright, and can be lifted in minutes when you need credit. Add NCTUE, the utility and telecom data exchange, since that is the file checked when someone opens power or phone service in your name.
Do I lose any rights by accepting the free credit monitoring?
No. Enrolling in breach-response monitoring does not waive your legal claims or your ability to participate in litigation. Enroll, and still freeze your credit — monitoring detects, freezing prevents.
How will I know if someone opened a utility account in my name?
Watch for collection notices or service letters from utilities you never contacted, unexpected items on your credit report, and new entries in your NCTUE file, which you can request for free. Report any fraudulent account to the utility and file a report at IdentityTheft.gov.
How do I stop my information being sold after a breach like this?
You cannot recall leaked data, but you can remove the broker listings that make it usable — your address history, phone numbers, relatives, and property records. PrivacyOn automates that across 100+ sites and keeps watching, so a single breach does not keep compounding.