Two separate utility data breach disclosures have landed on power and gas customers in the South this autumn. In mid-October, CenterPoint Energy told the Texas Attorney General’s Office that its incident “affected 1,062,060 Texas residents,” while Southern Company said on October 5 that an intruder had reached account details for “approximately 400,000 customers” of Georgia Power and Alabama Power.
Where it stands: Southern Company says affected customers are being notified by mail and email and offered a year of Equifax credit monitoring. CenterPoint did not appear to have sent letters to Texans as of Security Affairs’ October 16 report, and says it is still working out “which customers will be provided notifications in accordance with applicable legal requirements.”
Two utility data breach cases, side by side
The two incidents are not related, as far as any source shows. They share a theme, though: a utility has to know exactly who you are and where you live, so its customer files are rich targets.
| CenterPoint Energy | Southern Company | |
|---|---|---|
| Confirmed count | 1,062,060 Texans (Texas AG list) | About 400,000 customers |
| Claimed count | 7.49 million records (forum post, unverified) | None reported |
| SSN exposure | Social Security numbers, per the Texas filing | Last four digits only |
| Driver’s licenses | Yes, per the Texas filing | No |
| Entry point | An external-facing system | Online customer portal |
| Help offered | None described in reports so far | One year of Equifax monitoring |
CenterPoint Energy: what the Texas filing says
CenterPoint, based in Houston, first acknowledged trouble in a September filing with the SEC. Security Affairs quoted that filing as saying “an unauthorized third party obtained personal information relating to a portion of the Company’s customers through one of the Company’s external facing systems.” According to SecurityWeek, the company said it learned of the breach only after a criminal posted about it publicly, and that its operations were not affected.
The Texas Attorney General’s breach list is where a hard number finally appeared. SecurityWeek reports that, according to the company’s filing, the compromised information “includes names, addresses, Social Security numbers, and driver’s license numbers.” That combination is about as useful to an identity thief as customer data gets.
Texas is not the whole footprint. SecurityWeek points out that CenterPoint also serves customers in Indiana, Minnesota and Ohio, and that residents there “might have been affected as well. However, the total impact from the incident remains unclear.” No count for those states has been published.
The 7.49 million figure is a claim, not a count
You may see a much bigger number quoted. On September 12, according to Security Affairs, a forum user with the alias “4d722e4d656f77” claimed to have pulled “roughly 7.49 million customer records” from the utility. CenterPoint has not confirmed that number. Security Affairs itself notes the SEC filing does not “confirm the 7.49 million figure or detail exactly which fields were exposed.”
The same outlet adds an important warning about breach claims generally: “attackers often inflate numbers or repackage old data, so the final scope may differ from the claims.” Until CenterPoint publishes its own totals, 1,062,060 Texans is the confirmed figure and the forum number belongs in quotation marks.
Georgia Power and Alabama Power: a portal break-in
Southern Company’s incident came through the website customers use to manage their accounts. Georgia Power’s statement, carried by WSB-TV, reads: “We recently detected suspicious activity involving our online customer portal. An unauthorized third party accessed certain, limited information about the accounts of approximately 400K customers.”
The split, according to ABC 33/40 in Birmingham, is about 100,000 Alabama Power customers and “approximately 300,000 affected customers” at Georgia Power. The Atlanta Journal-Constitution adds that the roughly 100,000 outside Georgia were at “sister utilities in Alabama and Mississippi,” so Mississippi Power customers may also be among them.
The exposed fields were names, addresses, phone numbers, emails and the last four digits of Social Security numbers, WSB-TV reports. ABC 33/40 says “bank account numbers, payment card numbers and driver’s license numbers were not included in the affected information.” The company also told WSB-TV it has “not identified any evidence of ongoing unauthorized access.”
Why the last four digits still matter
A partial Social Security number cannot open a credit card by itself. It is, however, a detail that many phone help lines and account-recovery forms ask for when checking who you are. Pair it with a real name, home address and phone number, and a caller pretending to be your bank or your utility suddenly sounds very convincing.
That is the realistic risk for Georgia Power and Alabama Power customers: targeted phone and text scams, threats of disconnection and fake “refund” offers. Any caller who insists on instant payment by gift card or wire transfer to keep the lights on should be treated as a scammer until you have checked with the utility directly.
What utility customers should do now
Steps differ depending on which company holds your account.
- CenterPoint customers in Texas: because the filing lists full Social Security and driver’s license numbers, consider freezing your credit now rather than waiting for a letter. The federal USAGov identity theft guide lists the same move for victims: contact the three credit reporting agencies and ask them “to place fraud alerts and a credit freeze on your accounts.” Our walkthrough on how to freeze your credit after a data breach covers each bureau.
- Georgia Power and Alabama Power customers: watch your mailbox and inbox for the notice, then enroll in the Equifax monitoring it offers. Southern Company says notices go out “by U.S. mail and email using contact information previously provided to the company.”
- Everyone: log in to your utility account only by typing the address yourself or using the official app, and turn on any extra login protection the portal offers. Our guide to what to do if your utility account is compromised lists the settings worth checking.
- Watch for the warning signs USAGov lists: “Information on your credit report for accounts you did not open” and “Debt collection calls for accounts you did not open” are both reasons to act at once.
Customers outside Texas who get power or gas from CenterPoint should keep an eye out too. The company says it is still assessing “the scope of affected customer data,” and the Texas list may not be the last state filing it makes.
Frequently Asked Questions
How many CenterPoint Energy customers were affected by the data breach?
The only official count so far is for Texas: CenterPoint told the Texas Attorney General that 1,062,060 Texas residents were affected. The company also serves customers in Indiana, Minnesota and Ohio, and SecurityWeek says the total impact remains unclear. The 7.49 million figure came from a forum poster and has not been confirmed.
Was my full Social Security number exposed in the Georgia Power breach?
According to the company, no. Georgia Power and Alabama Power say the portal data included the last four digits of Social Security numbers, along with names, addresses, phone numbers and emails. Bank account, payment card and driver’s license numbers were not included.
How do I get the free credit monitoring from Southern Company?
Southern Company says customers identified as affected are being notified by U.S. mail and email, and are being offered one year of free credit monitoring through Equifax. The enrollment instructions should be in that notice.
Should I freeze my credit after a utility data breach?
If your full Social Security number or driver’s license number may be involved, as CenterPoint’s Texas filing describes, a freeze is a strong step because it stops new credit being opened in your name. It is free at each of the three credit bureaus and can be lifted when you need to apply for credit.
Are the CenterPoint and Georgia Power breaches connected?
No source links them. They involve different companies, different systems and different states, and both investigations were described as ongoing.
Sources
- CenterPoint Energy Data Breach: More Than 1 Million Texans Affected — Security Affairs (Pierluigi Paganini), October 16, 2026
- CenterPoint Energy Data Breach Impacts 1 Million Texans — SecurityWeek (Ionut Arghire), not shown on cached page (mid-October 2026, one month after the September SEC notice)
- Texas Utility CenterPoint Energy Confirms Data Breach After Hacker Claims 7.49M Records Stolen — Security Affairs (Pierluigi Paganini), September 16, 2026
- Georgia Power says hackers accessed information from about 400,000 customer accounts — WSB-TV Atlanta (Scott Flynn), October 5, 2026
- 100,000 Alabama Power Customers Affected in Southern Company Data Breach — ABC 33/40 (WBMA Birmingham), October 5, 2026
- Georgia Power data breach — The Atlanta Journal-Constitution (Kristi Swartz), October 2026 (week of October 5)
- Identity theft — USAGov (U.S. General Services Administration), last updated July 22, 2025
This article is news reporting and general security information based on the public sources listed above, as they stood on the dates shown. Incident details often change as investigations continue; check the affected company’s own status page and notices for the latest. Data Breach Radar is not affiliated with any company named here.