Data Breaches at Southern Company & CenterPoint Energy, Grocery Chain Network Disruptions, & OT Refrigeration Attacks
records exposed
hijacked refrigeration controls
for about six hours
This Week in Cybersecurity (TWiC), critical infrastructure, the food and agriculture sector, and essential industrial control systems faced widespread cyber threats. Threat actors breached customer-facing systems at two major utilities, exposing sensitive personal records for more than 1.4 million customers across the United States. Concurrently, a cybersecurity incident at Ahold Delhaize forced digital platforms offline across its grocery chains, while threat actors in France hijacked exposed industrial refrigeration control systems at hundreds of supermarkets, intentionally raising temperatures to ruin food supplies and disrupt physical operations.
Southern Company Customer Portal Breach Exposes 400,000 Accounts
Georgia Power and its parent company, Southern Company, disclosed on October 5 that an unauthorized third party had accessed its online customer portal. The incident affected approximately 400,000 customer accounts across its electric subsidiaries, including roughly 300,000 Georgia Power customers and 100,000 Alabama Power customers. Mississippi Power accounts were also affected, though the company has not disclosed how many.
Customer accounts affected
May be exposed
- Customer names
- Mailing addresses
- Phone numbers
- Email addresses
- Last four digits of Social Security numbers
- Other basic account details
Not accessed
- Bank account details
- Payment card numbers
- Driver’s license numbers
Based on the company’s investigation to date, the exposed information may include customer names, mailing addresses, phone numbers, email addresses, the last four digits of Social Security numbers, and other basic account details. Bank account details, payment card numbers, and driver’s license numbers were not accessed. Southern Company has not said when the intrusion occurred or how the attacker gained access to the portal.
Recommendations
- Conduct thorough threat-hunting investigations and forensic analysis across all web portals to identify potential unauthorized persistence or secondary access vectors.
- Implement robust rate limiting, adaptive authentication, and Web Application Firewall (WAF) protections to prevent automated scraping and unauthorized credential abuse.
- Regularly review user access controls, enforce phishing-resistant multifactor authentication (MFA) across all web portals, and monitor for anomalous login activity.
- Conduct external penetration testing to evaluate internet-facing infrastructure and identify potential attack paths before threat actors can exploit perimeter assets.
- Perform strategic security assessments to identify gaps in access controls, policy enforcement, and customer-facing data protection mechanisms.
- Engage cybersecurity incident response for immediate expert containment, investigation, and recovery when unauthorized portal activity or data exfiltration is detected.
Ahold Delhaize Brands Offline Alongside Attacks on Industrial Refrigeration Systems
Ahold Delhaize, a global retail parent company operating major U.S. grocery chains including Food Lion, Giant Food, The GIANT Company, Stop & Shop, and Hannaford, disclosed a cybersecurity incident on October 12 and took some network systems offline as a precaution. The shutdown caused widespread outages across customer-facing websites, mobile apps, and e-commerce delivery services while physical stores remained open. The incident also reached the company’s European operations, where Albert Heijn took logistics systems offline and paused online grocery deliveries, and the Etos and Gall & Gall brands were affected. Ahold Delhaize has since begun a controlled relaunch of certain systems and says it has no evidence that customer, associate, or partner data was taken.
Ahold Delhaize brands affected
Systems taken offlineUnited States
Europe
The disruption came the same day as a separate wave of physical OT attacks on the food sector, though no link between the two has been established. Overnight from Sunday, October 11, into Monday, October 12, attackers remotely accessed internet-exposed refrigeration controllers at hundreds of French supermarkets, including Danfoss AK-SM and AK-SC units and Copeland and Dixell XWEB systems. They forced cases into defrost with temperatures as high as 122°F (50°C) for about six hours, spoiling stock and sparking several fires.
Overnight, October 11 into October 12 / French supermarkets
In August, Claroty’s Team82 detailed authentication bypass and code execution flaws in the current Danfoss AK-SM 800A and Copeland XWEB Pro, but investigators have not linked those flaws to the attack or said how the attackers got in. Danfoss says most affected units were older AK-SM 800 and AK-SC 355 models that no longer receive updates, while the AK-SM 800A units involved were running outdated firmware.
Danfoss units involved
The attacks resemble unexplained refrigeration failures at U.S. military commissaries in late August; investigators are examining those incidents, but officials have not confirmed a cyberattack.
Recommendations
- Audit to locate and immediately eliminate direct public-facing IP connections to centralized industrial control panels, refrigeration controllers, and building automation systems.
- Enforce strict network segmentation to logically and physically isolate operational technology and environmental controls from corporate IT and web networks.
- Require all remote administrative access to industrial controllers to pass through encrypted VPNs or Zero Trust Network Access (ZTNA) with strict multi-factor authentication.
- Apply mandatory vendor security patches to active controllers, and establish an immediate replacement lifecycle for legacy, end-of-life devices.
- Conduct segmentation validation to verify that critical industrial control systems and building controls are strictly isolated from internet-exposed and corporate networks.
- Conduct internal penetration testing to evaluate internal network paths and identify misconfigured industrial assets, shadow IT, or elevated privileges accessible from compromised corporate environments.
CenterPoint Energy Data Breach Exposes Personal Information of Over 1 Million Customers
In a filing posted by the Texas Attorney General on October 13, CenterPoint Energy reported that a data breach exposed the personal information of more than 1 million Texas residents. Customers in Indiana and Minnesota, as well as the utility’s former Ohio gas customers, may also be affected. The Houston-based utility first confirmed the intrusion in a September 14 SEC filing, after a threat actor claimed to have stolen nearly 7.5 million customer records.
CenterPoint has said only that the data was obtained through one of its external-facing systems. The threat actor told BleepingComputer they extracted records by cycling through millions of customer IDs on a public API that lacked rate limiting and WAF protection, though CenterPoint has not confirmed those details. According to the Texas filing, the exposed data includes names, addresses, Social Security numbers, and driver’s license numbers; the threat actor also claims the stolen records contain phone numbers, account numbers, and billing details.
- Access
- One of CenterPoint’s external-facing systems
- Data exposed
- Names, addresses, Social Security numbers, driver’s license numbers
- May also be affected
- Customers in Indiana and Minnesota; former Ohio gas customers
- Method
- Cycling through millions of customer IDs on a public API lacking rate limiting and WAF protection
- Additional data
- Phone numbers, account numbers, billing details
While CenterPoint noted that electric and gas operations were not affected, the incident shows how weaknesses in external web services and public APIs can expose critical infrastructure organizations to large-scale data exfiltration and serious legal liability. A class-action lawsuit was filed in Houston on September 10, days before the company’s SEC disclosure.
Disclosure timeline
- September 10 Class-action lawsuit filed in Houston
- September 14 CenterPoint confirms intrusion in SEC filing
- October 13 Texas AG posts filing: 1M+ Texas residents
Recommendations
- Audit all external-facing APIs and public web endpoints to enforce strict rate limiting, input validation, and automated abuse detection.
- Deploy Web Application Firewalls (WAF) and API security gateways to identify and block automated enumeration or data scraping attempts.
- Ensure sensitive data such as Social Security numbers and driver’s license numbers are encrypted both in transit and at rest with restricted database access.
- Conduct comprehensive code reviews and API security assessments prior to deploying public-facing services.
- Conduct Web application and API penetration testing to systematically analyze public endpoints and identify rate-limiting bypasses, authorization flaws, and data leakage vectors.
- Perform strategic security assessments to review corporate data management policies, third-party interface security, and regulatory compliance postures across public-facing infrastructure.
- Engage cybersecurity incident response support for rapid threat containment, forensic investigation, regulatory reporting, and post-breach remediation.
Wrap
This week’s cybersecurity incidents show that threat actors are targeting every layer of critical infrastructure and commercial environments, from customer-facing web applications to operational technology on the physical store floor. Whether exploiting unauthenticated public APIs, leveraging internet-exposed industrial control panels, or targeting web portals, attackers continue to exploit weak perimeter security and missing network segmentation. Organizations across the utility, energy, and retail sectors must prioritize securing external endpoints, enforcing strict OT isolation, patching legacy control systems, and routinely testing their incident response and defense capabilities to prevent widespread operational disruption and data exposure.
Know where your attack paths lead? nGuard helps organizations identify exposed infrastructure, weaknesses in applications and APIs, credential risks, and gaps in incident readiness.
Talk to nGuard
