---
title: "Southern Company breach exposed 400,000 customer accounts as a class action lands in Georgia"
description: "Southern Company is being priced as the AI boom's power company in the same week a portal breach exposed about 400,000 customer accounts and drew a federal class action. Where the bill lands is a rate-case question, and rate cases are running at record volume."
publisher: "The Inference"
section: "Power"
published: 2026-10-10T17:19:38.867Z
modified: 2026-10-10T17:19:38.867Z
canonical: https://theinference.org/article/southern-company-breach-exposed-400-000-customer-accounts-as-a-class-action-lands-in-georgia
language: en
keywords: "Cybersecurity, Southern Company, Georgia Power, Utilities, Class Action, Rate Cases"
---

# Southern Company breach exposed 400,000 customer accounts as a class action lands in Georgia

> Southern Company is being priced as the AI boom's power company in the same week a portal breach exposed about 400,000 customer accounts and drew a federal class action. Where the bill lands is a rate-case question, and rate cases are running at record volume.

## About 400,000 customers are getting breach notices

An unauthorized third party read the account files of about 400,000 Southern Company customers through its online customer portal, the company [disclosed on October 5, 2026](https://www.securityweek.com/georgia-power-alabama-power-data-breach-hits-400000-accounts/). The exposed data: names, mailing addresses, phone numbers, email addresses and the last four digits of Social Security numbers, with no bank account, payment card or driver's license numbers involved. [1][2][3]

## Georgia has a count. Mississippi does not.

About 300,000 of the accounts are Georgia Power's, and roughly 100,000 are Alabama Power's, one in sixteen of its 1.6 million accounts. Mississippi Power is named as affected, with no figure released. [Southern has said](https://theinference.org/markets/companies/southern-company) neither when the intrusion happened nor how the attacker got in, so the liability cannot be sized. [1]

## The class-action bar moved in three days

A proposed class action [landed in Georgia federal court on October 8](https://www.law360.com/amp/articles/2535710), accusing the utility holding company of failing to adequately protect hundreds of thousands of customers' personal information. [4] A day later, Edelson Lechtzin opened a nationwide class investigation spanning Georgia Power, Alabama Power and Mississippi Power. [5]

## The stock is trading on the other story

Southern's shares held around $86 into the weekend, down 0.14%, a $99.10 billion market cap yielding a 3.53% dividend. [6] The week's market commentary framed the stock around [surging data-center demand in Georgia and the new reactors](https://theinference.org/article/google-is-paying-to-stretch-georgia-s-reactors-southern-s-stock-hit-a-52-week-low-anyway) whose round-the-clock output pairs with it. [7]

## The bill goes to a regulator, not just a jury

A regulated utility cannot raise prices unilaterally: every dollar of breach response, credit monitoring and litigation either hits earnings or enters the rate base, where customers repay it with a return. The commissions making that call face a record queue. US utilities filed [$18.6 billion of electric and gas rate-increase requests in the first half of 2026](https://gcn.com/rate-increase-requests-utilities-filed-record/22116/), after $31 billion in 2025. [8]

*Chart: **Utilities sought $18.6B in rate increases in six months, after a record $31B in 2025** Column chart showing US electric and gas utility rate-increase requests rising from $15B in 2024 to $31B in 2025, and $18.6B in the first half of 2026 alone.*

*Combined US electric and gas rate-increase requests filed with state regulators, per PowerLines' quarterly index as reported by GCN, October 2, 2026. The 2026 bar covers January through June only. [8]*

Every dollar of this breach gets priced twice: once by a court, once by a regulator deciding who repays it.

## What Southern's account leaves out

The company says it took immediate steps on detection, engaged law enforcement and found no evidence of ongoing unauthorized access, and [is paying for a year of Equifax credit monitoring](https://www.cbsnews.com/atlanta/news/georgia-power-customer-data-may-have-been-accessed-in-data-breach-company-says/). [2][3][9][10] Missing is what holders need most: when the intruder entered, and through what door. [1]

## Three markers decide it

The Georgia federal docket, the still-unreleased Mississippi Power count, and any disclosure of timing and method. The megawatts are priced. The liability is not.

## Takeaway

Southern's breach liability is unpriced because the company has not disclosed timing or method; the costs will be settled twice, in a Georgia courtroom and in a rate case, where utilities filed a record $31 billion of requests in 2025.

## Sources

1. [SecurityWeek, Eduard Kovacs, "Georgia Power, Alabama Power Data Breach Hits 400,000 Accounts", 7 October 2026](https://www.securityweek.com/georgia-power-alabama-power-data-breach-hits-400000-accounts/)
2. [WSB-TV, Scott Flynn, "Georgia Power says hackers accessed information from about 400,000 customer accounts", 5 October 2026](https://www.wsbtv.com/news/local/atlanta/cyberattack-georgia-power-exposed-info-400000-customers/HPJVDLIRENDPDJHPVS3HGUGWGA/)
3. [WBRC, "Nearly 100,000 Alabama Power accounts affected by Southern Company data breach", 5 October 2026](https://www.wbrc.com/2026/10/05/nearly-100000-alabama-power-accounts-affected-by-southern-company-data-breach/)
4. [Law360, Kelcey Caulder, "Utility Giant Southern Co. Sued Over Recent Data Breach", 8 October 2026](https://www.law360.com/amp/articles/2535710)
5. [Edelson Lechtzin LLP via GlobeNewswire, "Southern Company Data Breach Investigation: Edelson Lechtzin LLP Probes Class Action Claims After Customer Data Is Exposed", 9 October 2026](https://www.globenewswire.com/news-release/2026/10/09/3378339/0/en/southern-company-data-breach-investigation-edelson-lechtzin-llp-probes-class-action-claims-after-customer-data-is-exposed.html)
6. [Pluang, "Data breach exposes info of 400,000 Southern Company customers", 10 October 2026](https://pluang.com/en/news-feed/investigasi-pelanggaran-data-southern-company)
7. [Kalkine Media, Anmol Khazanchi, "Why is Southern Company (NYSE:SO) drawing attention as Georgia power demand surges?", 9 October 2026](https://kalkinemedia.com/us/stocks/utility/why-is-southern-company-nyseso-drawing-attention-as-georgia-power-demand-surges)
8. [GCN, Hugo Rojas, "US utilities filed a record $9.2 billion in rate increase requests in Q2 2026, with more than 56 million customers facing higher bills", 2 October 2026](https://gcn.com/rate-increase-requests-utilities-filed-record/22116/)
9. [CBS News Atlanta, Dan Raby, "Georgia Power customer data may have been accessed in data breach, company says", 5 October 2026](https://www.cbsnews.com/atlanta/news/georgia-power-customer-data-may-have-been-accessed-in-data-breach-company-says/)
10. [FOX 5 Atlanta, "Georgia Power notifies 300K customers about suspicious online activity", 5 October 2026](https://www.fox5atlanta.com/news/georgia-power-notifies-300k-customers-about-suspicious-online-activity)


---

Southern Company breach exposed 400,000 customer accounts as a class action lands in Georgia — The Inference. Canonical: https://theinference.org/article/southern-company-breach-exposed-400-000-customer-accounts-as-a-class-action-lands-in-georgia