Southern Company is notifying roughly 400,000 customers that their utility account information was accessed by an unauthorized third party through its online customer portal.
The Atlanta-based energy holding company serves more than 9 million customers through electric utilities in three states and natural gas distribution businesses in four. Its electric subsidiaries are Georgia Power, Alabama Power and Mississippi Power.
Roughly 300,000 of the affected accounts belong to Georgia Power customers. According to Southern Company, the incident also impacted roughly 100,000 of Alabama Power’s 1.6 million accounts.
Mississippi Power is named as affected in the company’s public notice, but no figure has been released for its customers.
“An unauthorized third party accessed certain, limited information about the accounts of approximately 400K customers. Upon detection, we took immediate steps to stop the activity and have engaged law enforcement,” the company said in a statement sent to the media.
Southern Company’s public notice specifies the type of data involved. “Based on our investigation to date, the limited customer account information that the unauthorized party gained access to includes the customer’s name, mailing address, phone number, email, or the last 4 digits of their Social Security Number, and other basic account details,” the notice reads.
The utility says the attacker did not access bank account numbers, payment card numbers or driver’s license numbers.
Southern Company has not said when the intrusion took place or how the attacker gained access to the portal.
Impacted customers are being notified by mail and email and offered a year of free credit monitoring.
Related: ASOS Confirms Cyberattack, Data Breach
Related: Advantest Discloses Data Breach Months After Ransomware Attack
Related: 8.8 Million Impacted by Data Breach at Denmark’s Central Person Register
Related: Personal Information for Over 1 Million People Stolen in a Cyberattack on Arizona’s Court System
