Home · Wiki · Incidents & Campaigns
type: incident · created: 2026-11-01 · updated: 2026-11-01 · tags: [incident, energy-utilities, breach] · confidence: high · severity: high · affected_sectors: [energy-utilities] · au_impact: true

STP Nuclear Operating Co., the nonprofit that runs the South Texas Project Electric Generating Station near Bay City, notified the Texas attorney general's office of a data security incident affecting nearly 1,200 Texans. Compromised data includes names, Social Security numbers, birthdates and other personal information; affected individuals were notified by email. The notice did not say whether the plant's operating or safety systems were involved, but a Nuclear Regulatory Commission spokesperson said the agency "remains satisfied that the South Texas Project plant continues operating safely and securely in accordance with agency requirements." The 35-year-old, two-reactor facility produces 2.7 gigawatts — enough for about two million homes — and is co-owned by CPS Energy, Austin Energy and Constellation South Texas LLC. Critical-infrastructure operators such as STP must report certain cyber incidents to the Texas Cyber Command; the command did not respond to a request for comment. Texas law requires breaches affecting 250 or more residents to be reported within 30 days.

Attribute Detail
Sector Energy & Utilities
Date 2026-11-01
Source GovTech
Reliability Tier 2
Breach classification Confirmed breach