Georgia Power Data Breach: Customer Portal Access

The Atlanta Journal-Constitution and CBS Atlanta reported on October 6, 2026 that Georgia Power had notified regulators of unauthorised access to its online customer portal. Customers of sister Southern Company utilities in Alabama and Mississippi were also affected. The company said it stopped the access, contacted law enforcement, and found no ongoing access.

According to the AJC and CBS Atlanta, the exposed data included names, addresses, phone numbers, email addresses, basic account details, and the last four digits of Social Security numbers. Bank account, payment card, and driver's licence numbers were reported as not involved.

The AJC reported about 300,000 of Georgia Power's 2.8 million customers affected, plus about 100,000 at sister utilities. Other outlets described about 400,000 Southern Company accounts in total.

How the portal was accessed, whether by credential stuffing, a vulnerability, or another method, had not been reported. The intrusion window and the actor were also not disclosed. Consumer advocates criticised the timing of the notice, according to local reporting.

Customer portals are frequent targets. Credential stuffing tries leaked username and password pairs at scale. Enumeration abuses account lookup or password reset flows to harvest data. Authorisation flaws let a logged-in user retrieve other customers' records by changing an identifier. Each produces a breach without breaching core systems.

Detect and block high-volume login attempts across many accounts, check passwords against breached password lists, offer and encourage multi-factor authentication, and use bot detection on login and reset flows. These controls stop most automated attacks on portals.

Every API call that returns customer data must check that the requester owns the account, not just that they are logged in. Insecure direct object references remain a common source of large portal breaches and are found by testing every endpoint with another user's identifiers.

Portals often display more than customers need. Showing partial SSNs or full addresses across many screens increases what attackers can harvest. Minimise displayed data and require re-authentication for sensitive views.

Utility portals connect to billing and, in some cases, service management. Even when a breach affects only customer data, regulators and the public expect strong security from critical infrastructure providers, and public utility commissions may ask for updates, as Georgia's did.

According to reports, Georgia Power is notifying customers, offering free credit monitoring, and running a dedicated support line. The Georgia Public Service Commission asked for updates.

Expect phishing that references your utility account or bills. Verify any contact by calling the number on your bill. Consider the offered monitoring and a credit freeze, and enable MFA on your utility account if available.

Regulators notified on a Friday, public announcement Monday, October 6, 2026, per the AJC. Intrusion dates had not been reported.

A portal breach without a disclosed method still teaches familiar lessons: stop credential stuffing, check authorisation on every call, and show less data.

The last four digits of a Social Security number are often used in identity verification by banks, utilities, and call centres. Combined with name, address, and phone number, they help attackers pass knowledge-based checks and impersonate customers. Organisations should stop relying on SSN fragments as authentication factors.

Regular penetration tests focused on authorisation, rate limiting, and account recovery flows catch most portal weaknesses. Include automated tests that try accessing another customer's records through every API endpoint, and run them in CI so new endpoints cannot ship without the check.

Consumer advocates criticised how quickly customers were told, according to local reporting. Utilities and other regulated providers face scrutiny on notification speed as well as security. Pre-approved notification templates, legal review paths, and customer contact processes reduce the time between detection and notice.

Customers of sister utilities in other states were affected too, suggesting a shared portal or platform across Southern Company subsidiaries. Shared platforms reduce cost but share risk; a flaw in one affects all.

Investigation ongoing at the time of writing.