Texas Nuclear Plant Operator Reports Data Breach
Nearly 1,200 individuals were impacted by unauthorized access to sensitive personal records at the energy facility.
Updated on Oct. 30, 2026 in Cybersecurity
Live Poll
Do you trust local utility providers to keep your personal data secure?
STP Nuclear Operating Co. has disclosed a data breach exposing the personal information of nearly 1,200 Texans. The nonprofit operator notified the state attorney general after identifying the unauthorized access.
Why it matters
The incident highlights the growing volume of data security disclosures in the state, where companies are mandated to report breaches involving more than 250 individuals within 30 days of discovery.
The breach at the 2.7-gigawatt facility in Bay City exposed names, Social Security numbers, and birthdates. The state has seen 573 breach notifications filed this year alone, compared to a baseline that requires reporting only when a breach exceeds 250 affected individuals.
The players
STP Nuclear Operating Co.
A nonprofit company that operates the two-reactor South Texas Project nuclear facility.
CPS Energy
A municipal utility and part-owner of the South Texas Project power facility.
Austin Energy
The municipally owned electric utility for Austin and part-owner of the power facility.
Constellation South Texas LLC
A subsidiary of a major energy company that serves as a part-owner of the nuclear facility.
The details
The South Texas Project plant uses two nuclear reactors to generate power for two million homes. Operators are required to provide notice of compromised consumer data to the Texas attorney general's office to ensure public transparency. The 35-year-old facility is managed by STP Nuclear Operating Co., which is owned by a consortium of energy companies.
Timeline
July 2024: A reactor went offline due to power loss and a switchyard fire.
October 2025: The facility declared an unusual event.
2025: Initial breach notices were filed with the attorney general.
2026: 573 total data breach notices were filed with the state.
The Tech Race
The incident reflects the increasing compliance burden under the Texas Data Breach Notification Law. With 573 filings in 2026 alone, the state is seeing a rapid escalation in the documentation of cybersecurity exposures compared to previous years.
Affected individuals have been contacted via email regarding the compromise of their sensitive personal information. Recipients should monitor their credit reports and account statements for unauthorized activity following the disclosure.
The takeaway
Entities operating critical infrastructure are increasingly visible in state breach registries as regulatory scrutiny intensifies. Residents should maintain heightened vigilance for phishing attempts that leverage the personal identifiers exposed in this incident.
Further reading
For broader trends in regional security, explore our Cybersecurity coverage.
Source note: This article includes information reported by Austin American-Statesman.
Live Poll
Do you trust local utility providers to keep your personal data secure?
