Southern Company has faced proposed class actions in Georgia federal court over its online-portal breach, disclosed on 5 October 2026, which exposed limited data for about 400,000 utility accounts. The earliest report of a suit dates to 8 October, according to Law360, and a further Georgia-resident suit was described in a 25 October report citing WSB-TV Channel 2, Atlanta. Whether the reports describe the same filings or separate ones is not established in the sources verified for this article.
Southern Company is the Atlanta-based holding company behind Georgia Power, Alabama Power and Mississippi Power. The breach itself is company-confirmed; the litigation is the new development.
The breach, confirmed
Southern Company disclosed the breach in a public statement on 5 October 2026 and is notifying affected customers by mail and email. An unauthorised third party accessed certain limited customer account information through the company’s online customer portal, affecting approximately 400,000 accounts. The company said it took immediate steps to stop the activity on detection, engaged law enforcement, and found no evidence of ongoing unauthorised access.
The split of affected accounts is roughly 300,000 Georgia Power accounts and roughly 100,000 Alabama Power accounts. Mississippi Power is named as affected in the company notice, but no figure has been released for it. The data involved, per the company’s notice, is the customer’s name, mailing address, phone number, email, the last four digits of their Social Security Number, and other basic account details. TEISS and ClassAction.org also report the last four digits of business tax IDs among the data involved. The company said bank account numbers, payment card numbers and driver’s licence numbers were not accessed. Affected customers are offered one year of free credit monitoring.
The company has not publicly said when the intrusion took place or how the attacker gained access to the portal, and the attacker’s identity has not been publicly confirmed.
The lawsuits
Law360 carried an item on 8 October describing a proposed class action against Southern Company in Georgia federal court, accusing the company of failing to adequately protect hundreds of thousands of customers’ personal information. A further Law360 item on 13 October described a Georgia Power customer suit alleging inadequate cybersecurity practices. A 25 October report by Wisevoter, citing WSB-TV Channel 2, Atlanta, described a Georgia-resident suit seeking a jury trial and, among other relief, statutory, compensatory and punitive damages plus legal fees, alleging failure to implement necessary encryption, failure to adequately identify cyber threats, and insufficient care in cybersecurity measures.
The reports do not establish whether these items describe the same filings or separate ones. This article does not name a plaintiff, docket number, or filing law firm for the suits described. Southern Company has not provided a substantive response to the allegations in the sources verified for this article. No specified dollar amount is sought in the reports verified. The full text of the Law360 items was not read.
Two claims the company notice does not support
Two further claims circulate around this breach, and the company notice does not support either of them. They are reported here as claims, not as facts.
First, an Ademi LLP investigation release dated 14 October lists compromised information as possibly including full Social Security Numbers and financial account and payment card information. That differs from the company notice, which says only the last four digits of Social Security Numbers were involved and that bank and payment-card numbers were not accessed. The law-firm list is investigation wording, not a verified incident record, and it must not be merged into the company-confirmed data list.
Second, secondary reporting describes the intrusion as occurring in September 2026. The company has not disclosed when the intrusion occurred, so September remains a secondary-reported date, not a company-confirmed one.
The numbers behind the case
The following figures are our analysis, calculated from the confirmed numbers above:
Alabama accounts for about 100,000 of the roughly 400,000 affected accounts, or about 25 percent of the affected total, against Georgia’s roughly 300,000, or about 75 percent. That split covers only the two quantified subsidiaries, since Mississippi Power’s share is unquantified. Against Alabama Power’s 1.6 million reported account base, the 100,000 affected accounts represent about 6.25 percent. Against Southern Company’s more than 9 million customers served, the 400,000 accounts are roughly 4.4 percent, though that figure is indicative only, because the 9 million denominator includes natural-gas customers while the breach concerned electric-utility portal accounts.
The sequence of reports runs from the company’s 5 October disclosure through the Law360 item on 8 October, the investigation announcement on 9 October, the Law360 item on 13 October, the investigation announcement on 14 October, and the Wisevoter report on 25 October.
What to watch next
Three things would move this story forward: Southern Company’s response to the suits, court details becoming public, and whether additional suits follow. This article will be updated if Southern Company responds or if court details become public. Nothing in the sources verified for this article indicates a second intrusion or newly affected accounts; the new element is litigation about the October breach.
For affected customers, the practical step is the one Southern Company already offers: enrol in the free year of credit monitoring when the mailed or emailed notice arrives, and treat unexpected messages about the account with suspicion until verified through the company’s official channels.
Sources
SecurityWeek, “Georgia Power, Alabama Power Data Breach Hits 400,000 Accounts”, October 2026. Read the SecurityWeek report. TEISS, “Southern Company says attacker accessed data on 400,000 utility accounts through online portal”, October 2026. Read the TEISS report. ClassAction.org, “Southern Company Data Breach Reported; Customer Info Exposed”, October 2026. Read the ClassAction.org report. GlobeNewswire and Edelson Lechtzin LLP, “Southern Company Data Breach Investigation”, 9 October 2026. Read the Edelson Lechtzin release. Law360, Cybersecurity and Privacy index, 8 October 2026 item “Utility Giant Southern Co. Sued Over Recent Data Breach”. Read the Law360 index. Law360, Cybersecurity and Privacy index, 13 October 2026 item “Georgia Utility Failed To Protect Personal Info, Customer Says”. Read the Law360 index. Wisevoter, “Georgia Resident Files Class-Action Against Southern Co.”, 25 October 2026, read directly, citing WSB-TV Channel 2, Atlanta. Read the Wisevoter report. GlobeNewswire and Ademi LLP, investigation release, 14 October 2026, cited only for the claimed data list that differs from the company notice. Read the Ademi LLP release. IT Security News, “Southern Company Discloses Data Breach Affecting 400,000 Georgia Power and Alabama Power Customers”, October 2026, cited only for the secondary-reported September intrusion date. Read the IT Security News report. ClassActionU, “Southern Company Data Breach”, October 2026, cited only for secondary reporting of the September date. Read the ClassActionU report.
