Georgia Power, Alabama Power and Mississippi Power customers whose account information was accessed in Southern Company’s 2026 customer-portal breach may be covered by proposed class actions alleging Southern Company failed to adequately protect their personal information. No class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes class action lawsuits. The claims in them are unproven allegations. Southern Company, Georgia Power and Alabama Power have not been found liable, there is no certified class, and nothing to claim at this time. This page is informational and is not legal advice.
What Happened at Southern Company?
Southern Company, the Atlanta-based parent of Georgia Power, Alabama Power and Mississippi Power, disclosed on October 5, 2026 that an unauthorized third party had accessed customer account information through its online customer portal. In its notice, the company says it found the activity through its own monitoring, stopped it, brought in law enforcement and, based on its review so far, has found no evidence of ongoing unauthorized access. The notice does not say when the access began or how the intruder got in.In a statement reported by SecurityWeek, the company put the number of affected customers at approximately 400,000. Local reporting broke that down as roughly 300,000 Georgia Power customers and roughly 100,000 Alabama Power customers. Mississippi Power accounts were also involved, according to the company’s notice, but no count for them has been released.
Within two days of the disclosure, the first proposed class action was filed in the U.S. District Court for the Northern District of Georgia. Law360 reported on October 8 that the suit accuses the utility holding company of failing to adequately protect the personal information of hundreds of thousands of customers. No court has ruled on any of the allegations.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
The Lawsuits Filed So Far
The suit tied to the breach is Hill v. The Southern Company, No. 1:26-cv-05813, filed October 7, 2026 in the Atlanta-based Northern District of Georgia against Southern Company and Alabama Power Company and assigned to U.S. District Judge Mark H. Cohen. Its filing date and defendants match the suit Law360 described on October 8. Its docket lists a class action complaint with a jury demand. The complaint was not publicly available for review, so the specific legal claims, the proposed class definition and the relief sought are not yet known.A separate proposed class action, Pursley v. Georgia Power Company, No. 1:26-cv-05877, was filed in the same court on October 12, 2026 against Georgia Power and Southern Company. Its docket classifies it as a contract case alleging breach of fiduciary duty and does not mention a data breach, so OCA has not confirmed that it concerns this incident.
What Southern Company Says Was Exposed
According to Southern Company’s notice, the information the unauthorized party reached includes the customer’s name, mailing address, phone number, email address, or the last four digits of the Social Security number, along with other basic account details. The company says no bank account numbers, payment card numbers or driver’s license numbers were accessed.The notice says affected customers are being contacted directly by U.S. mail and by email at the address on file, and that the letters include instructions for enrolling in one year of free credit monitoring through Equifax. It also warns customers about people impersonating Georgia Power representatives, a common follow-on risk when names, phone numbers and email addresses are exposed together.
Which Customers Are Involved
The company’s notice names accounts at three electric utilities: Georgia Power, Alabama Power and Mississippi Power. It does not mention Southern Company Gas or its gas utilities, including Atlanta Gas Light, Nicor Gas, Virginia Natural Gas and Chattanooga Gas, and no reporting reviewed for this page ties those brands to the incident.Only customers whose information was actually accessed are being notified. Georgia Power serves about 2.8 million customers and Alabama Power about 1.6 million, so the affected group is a small share of each utility’s customer base.
What Is Still Unknown
Southern Company has not said when the intrusion began, how long it lasted or how the intruder reached the portal. No breach notice from the company was found on the California or Texas attorney general breach portals as of October 23, 2026, so the 400,000 figure rests on the company’s own statement rather than a state filing. The complaints, once available, may add detail about the timeline and the legal claims.Several law firms have also announced that they are investigating the breach, which often signals that more suits may follow. Other 2026 breaches drew several suits within weeks of disclosure, including the OneMain Financial data breach lawsuits and the World Acceptance data breach lawsuits.
What Happens Next
If more suits over the breach are filed, they may be combined into one case. Southern Company and its subsidiaries would then respond, often with a motion to dismiss. Data breach class actions that survive that stage frequently settle; settlements in these cases typically reimburse documented losses, sometimes pay a flat amount, and require a claim form.There is nothing to file in the lawsuits now. If a settlement is reached, people whose information was involved would normally receive a notice explaining how to file a claim.
Questions
Is there a Southern Company data breach class action?
Yes. Law360 reported on October 8, 2026 that Southern Company had been hit with a proposed class action in Georgia federal court over the breach. Court records show Hill v. The Southern Company, No. 1:26-cv-05813, filed October 7, 2026 against Southern Company and Alabama Power, in the U.S. District Court for the Northern District of Georgia. The case is at the complaint stage. No class has been certified, there is no settlement, and there is nothing to claim yet.
What information was exposed in the Southern Company breach?
Southern Company’s notice says the unauthorized party reached limited account information: the customer’s name, mailing address, phone number, email address, or the last four digits of the Social Security number, plus other basic account details. The company says no bank account numbers, payment card numbers or driver’s license numbers were accessed.
How many customers were affected by the Southern Company data breach?
About 400,000 customers, according to a company statement reported by SecurityWeek. News reports put roughly 300,000 of them at Georgia Power and roughly 100,000 at Alabama Power. Mississippi Power customers were also affected, but no count for them has been released.
Were Southern Company Gas customers affected?
Southern Company’s notice names accounts at Georgia Power, Alabama Power and Mississippi Power only. It does not mention Southern Company Gas or its gas utilities, such as Atlanta Gas Light, Nicor Gas, Virginia Natural Gas or Chattanooga Gas.
What happens next in the Southern Company lawsuits?
More suits may be filed, and related cases in the Northern District of Georgia may be consolidated. Southern Company would then respond, often with a motion to dismiss. If the case settles, people whose information was involved would normally be notified and told how to file a claim.
Sources
• Southern Company: Information Regarding a Recent Incident Involving Customer Information (company notice).• Docket, Hill v. The Southern Company, No. 1:26-cv-05813 (N.D. Ga., filed October 7, 2026): Justia docket.
• Docket, Pursley v. Georgia Power Company, No. 1:26-cv-05877 (N.D. Ga., filed October 12, 2026; not confirmed to concern the breach): Justia docket.
• Law360: Utility Giant Southern Co. Sued Over Recent Data Breach (October 8, 2026).
• SecurityWeek: Georgia Power, Alabama Power Data Breach Hits 400,000 Accounts (October 7, 2026).
• ABC 33/40: 100,000 Alabama Power Customers Affected in Southern Company Data Breach (October 5, 2026).
