The only count of Southern Company's breach is its own: about 400,000 accounts, no date, no cause
Southern says an intruder reached about 400,000 customer accounts through its online portal and will not say when or how; with no regulator count, the first test of whether the breach reaches the financials comes with third-quarter results on November 5.
Richard Tang · 3 min read
Southern Company+1.26% — Southern Company, up 1.26 percent today is the second large US utility in a month to lose customer data through an internet-facing system 7, and the only number attached to the breach is one Southern set itself: about 400,000 customer accounts reached through the online customer portal 12. The company has put no date on the intrusion and no explanation of how it happened 1. Notices to those customers are going out by US mail and email this week 12. Whether the breach reaches the financials gets its first test on November 5 5.
The way in was the customer portal, not the grid
Southern, the Atlanta parent of Georgia Power, Alabama Power and Mississippi Power, said on October 5 that an unauthorized third party reached limited account information: names, addresses, phone numbers, emails, and the last four digits of Social Security numbers and business tax IDs 1. It says bank account, payment card and driver's license numbers were not touched, and it is offering affected customers a year of free credit monitoring 2.
Roughly 300,000 of the accounts sit at Georgia Power, which serves 2.8 million customers 23. Another 100,000 are at Alabama Power, and Mississippi Power is named as affected with no figure released 1. CenterPoint Energy disclosed its own breach, also through an external-facing system, in an SEC filing in September 7.
The count stands on the company's word
Edelson Lechtzin, a national class-action firm, opened an investigation on October 9, and Ademi LLP, a class-action firm, followed on October 14 14. Ademi's notice lists financial account and payment card data among what may have been compromised, categories Southern says were never accessed 42. That gap between what is claimed and what is disclosed is where these cases get argued.
At CenterPoint, the Texas attorney general now counts 1,062,060 affected Texans and reports the utility still had not notified them 7. At Southern, no regulator count has surfaced since the October 5 statement, while the Atlanta Journal-Constitution placed the portal intrusion in the week before the disclosure and the company confirmed nothing 31.
November 5 decides whether the breach reaches the financials
The quarter already carries Hurricane Isaias: Southern's utilities had restored about 420,000 customers by October 10, with roughly 80,000 still out 5. Analysts expect $1.65 of earnings per share, against $1.60 a year earlier 5. Revenue consensus sits at $8.26 billion, versus $7.82 billion in last year's quarter 5.
For a company worth about $100 billion 5, monitoring and legal defense are small costs. For a regulated utility they get argued in front of the state commissions that set rates, which is why disclosure matters more than damages here. BofA and JPMorgan cut their targets on October 13 5, and KeyBanc analyst Sophie Karp carries a Sell at $74, the outlier in a target set still clustered in the nineties 56.
KeyBanc's Sell target sits far below a consensus still clustered in the nineties
Data
| Value | |
|---|---|
| KeyBanc (Sell) | $74 |
| Southern Co price | $87.82 |
| BofA (Neutral) | $92 |
| JPMorgan (Neutral) | $94 |
| Analyst consensus | $98.33 |
Inside the company, insider sentiment reads negative: 51 insiders have been net sellers over the past quarter 6. Comptroller Matthew M. Kim sold 1,400 shares for $124,418 last month 6.
A company that counts its own breach and will not date it is asking 400,000 customers, two law firms and its state regulators to take its arithmetic on trust. November 5 is the first checkpoint on what that trust costs.
Deepdive
AI-generated from this story and its cited sources. Not investment advice.
