Southern Company's online portal exposed account data on about 400,000 utility customers

The state figures already add up to the company's total. Georgia Power's and Alabama Power's counts come to roughly 400,000 together ^[12], so Mississippi Power's share fits inside the rounding of the headline number. Georgia alone is three quarters of the total ^[13]. In Alabama, the affected accounts are 6.25 percent of the subsidiary's base, about one account in 16 ^[11].

The public notice lists the fields. "Based on our investigation to date, the limited customer account information that the unauthorized party gained access to includes the customer's name, mailing address, phone number, email, or the last 4 digits of their Social Security Number, and other basic account details," the notice says ^[7]. The "or" in that list means not every customer lost every field.

Southern Company has not said when the intrusion took place or how the attacker got into the portal ^[9]. "An unauthorized third party accessed certain, limited information about the accounts of approximately 400K customers. Upon detection, we took immediate steps to stop the activity and have engaged law enforcement," the company said in a statement to the media ^[6].

Southern Company runs electric utilities in three states and gas distribution businesses in four, serving more than 9 million customers ^[2]. Everything it has disclosed about this incident concerns customer records reached through a customer-facing website ^[1][7]. On that evidence this is a consumer data breach at a utility. It is not evidence that self-service portals open a path into the systems that run generation or the grid.