400,000 Utility Accounts Breached in Portal Attack

Southern Company, the Atlanta-based energy holding company behind Georgia Power, Alabama Power and Mississippi Power, is notifying roughly 400,000 customers that an unauthorised third party accessed their accounts through its online customer portal, according to Security Week.

Around 300,000 of those accounts belong to Georgia Power customers. Alabama Power accounts for the remaining 100,000. Mississippi Power is listed as affected, but no figure has been released for its customers.

The attacker got names, mailing addresses, phone numbers, email addresses, and in some cases the last four digits of Social Security numbers. Bank account numbers, payment card numbers and driving licence details were not accessed, the company says.

Southern Company has not disclosed how the attacker got into the portal, or when.

Affected customers will receive notification by mail or email and are being offered one year of free credit monitoring. Accept it. Even if the exposed data feels minor, partial Social Security numbers combined with addresses are enough to assist identity fraud.

If you are a Southern Company customer, also consider placing a free credit freeze with all three major bureaus — Equifax, Experian and TransUnion. A freeze costs nothing and prevents anyone from opening new accounts in your name, regardless of what data they hold.

ClickFix is a social engineering (manipulation technique that exploits human trust rather than software flaws) attack where victims are shown a fake error message or CAPTCHA, then told to paste a command into Windows PowerShell or macOS Terminal to "fix" the problem. The command is already on their clipboard. They just have to paste it.

Now, according to Dark Reading, attackers are hiding the malicious payload inside DNS TXT records (small text parcels attached to website domain settings) and pre-loading attack scripts into your browser's cache before you even click anything. Both methods put the dangerous code on your device earlier in the process, giving security tools less time and context to catch it.

The rule here is simple: no legitimate website, software update, or CAPTCHA will ever ask you to paste a command into your terminal or Run box. If something does, close the tab.

What Atlassian's products are: Atlassian makes widely used business collaboration and development tools — Jira for project tracking, Confluence for team wikis, Bitbucket for code storage, and several others used by software teams worldwide.

What it is: An arbitrary file access flaw — meaning an attacker can request and read specific files on the server without logging in, as long as they know the file's exact path.

Who's at risk: Anyone running a self-hosted instance of any of the eight affected products. Cloud-hosted Atlassian customers are not affected.

CVSS: 9.3 (Critical — patch today.)

Root cause: The server fails to verify whether a requesting user has permission to access a file before returning it. If the attacker already knows the file path — and for common configurations, paths are predictable — there is nothing stopping retrieval. Organisations using Crowd for single sign-on are at heightened risk because authentication credentials are stored in plaintext at a known location.

Attack vector: An unauthenticated attacker sends a crafted HTTP request pointing at a known file path. The server returns the file. No login required. With SSO credentials in hand, the attacker can then create admin accounts and move freely through the environment.

Detection strategies: Look for unusual GET requests to configuration or credential file paths in your web server logs. Monitor for new admin account creation outside normal provisioning windows. Flag external access to Crowd endpoints.

Recommended actions:

1. Patch all affected products immediately using the fixed versions listed in the Atlassian advisory.
2. If patching is not immediately possible, block external internet access to your Atlassian instances entirely.
3. Deploy WAF (web application firewall) rules per Atlassian's guidance as a temporary mitigation.

Google has released Chrome 155, patching 247 security vulnerabilities including four rated Critical. All four critical flaws are use-after-free bugs (where a program keeps using memory after it has been freed, allowing attackers to hijack it). None are confirmed as actively exploited yet — but that window closes fast once patches are public.

Updating takes under a minute. In Chrome, go to the three-dot menu in the top right, select Help, then About Google Chrome. The update will download automatically. Click Relaunch when prompted.

Chrome is used by the majority of internet users worldwide. Keeping it current is one of the highest-return security habits available to anyone, at no cost.

The U.S. Senate has unanimously passed the Health Care Cybersecurity and Resiliency Act of 2026, driven by the Change Healthcare ransomware attack that exposed health data for 190 million Americans. The bill requires healthcare organisations to adopt minimum security standards including multi-factor authentication (a login method requiring a second verification step beyond your password), and mandates coordination between HHS and CISA on incident response. For patients, it means healthcare providers must now disclose the total number of people affected by any breach. The bill moves to the House next.