Southern Company’s public notice specifies the type of data involved. “Based on our investigation to date, the limited customer account information that the unauthorized party gained access to includes the customer’s name, mailing address, phone number, email, or the last 4 digits of their Social Security Number, and other basic account details,” the notice reads.

The utility says the attacker did not access bank account numbers, payment card numbers or driver’s license numbers.

Is it normal for US utilities to have Social Security or Drivers License details?!

They may be running credit checks on customers. Also, they may need to pass this information on to a collection agency in the case of non-payment.