Southern Company Portal Breach Exposes 400k Utility Accounts Including Partial SSNs

Southern Company disclosed that the intruder reached limited fields through Georgia Power, Alabama Power, and Mississippi Power portals serving over 9 million total customers. The company stated it halted access upon detection and notified law enforcement, yet withheld intrusion date, entry vector, and duration. Affected customers receive one year of credit monitoring; no payment or full SSN data was reached.

Public notice and media reporting confirm the data set matches typical utility CRM exports but omit authentication logs or MFA status. Procurement records show Southern utilities have invested in customer portals under DOE grid modernization grants since 2018, yet no CVE or patch timeline has surfaced. This gap matches patterns in prior utility incidents where vendors delayed disclosure until regulatory filings.

The breach aligns with repeated observations of portal credential stuffing or session token abuse in energy sector filings. Official statements emphasize containment while independent monitoring of dark web dumps has already flagged partial customer lists. Attribution remains open; technical artifacts do not yet support state-actor claims made in some regulatory briefings.

Next steps include state AG notifications and potential NERC CIP audit triggers. Expect class-action filings within 60 days and renewed pressure on utilities to publish portal vulnerability scans.