STP Nuclear Operating Co. Reports Data Breach

A data security incident at the South Texas nuclear power plant has compromised the sensitive information of 1,200 Texans.

Updated on Oct. 30, 2026 in Cybersecurity

An industrial cooling tower stands in a vast, arid landscape under a clear sky. — STP Nuclear Operating Co. has reported a data breach to the Texas attorney general, affecting the personal information of 1,200 residents. AI Illustration. Upload story photo >

Live Poll

Do you trust local utility providers to keep your personal data secure?

STP Nuclear Operating Co. has notified the Texas attorney general of a data breach affecting nearly 1,200 individuals. The compromised information includes names, Social Security numbers, and birthdates.

Why it matters

Texas law requires businesses to notify the attorney general of any security incident impacting 250 or more residents. This regulation ensures that authorities are alerted to potential identity theft risks for residents in a timely manner.

The breach impacted 1,200 individuals associated with the 35-year-old power facility in Bay City. The plant produces 2.7 gigawatts of power, enough to serve approximately 2 million homes.

The players

STP Nuclear Operating Co.

This nonprofit company operates the South Texas Project nuclear power plant located in Bay City.

CPS Energy

This municipal utility provider is one of the co-owners of the South Texas Project nuclear facility.

Austin Energy

This public power utility is a co-owner of the South Texas Project facility.

Constellation South Texas LLC

This entity maintains a co-ownership stake in the South Texas Project nuclear power plant.

The details

The nonprofit company confirmed that affected individuals received email notifications regarding the exposure of their personal data. The breach was reported in accordance with state laws requiring businesses to disclose security incidents to the attorney general within 30 days of discovery.

July 2024: The plant experienced a reactor shutdown due to power loss and a switchyard fire.
October 2025: The operator declared an unusual event at the nuclear plant facility.
2026: A total of 573 data breach notices have been filed with the state attorney general so far this year.

The Tech Race

This reporting mandate reflects a broader regulatory trend aimed at curbing identity theft through mandatory corporate transparency. The state is tracking a significant increase in incidents, with 573 notices filed this year out of 686 total notices currently on the state breach list.

Individuals who received an email notification should prioritize monitoring their credit reports for unauthorized activity. Protecting sensitive details like Social Security numbers and birthdates is critical to preventing long-term identity theft.

The takeaway

Entities holding sensitive personal data remain targets for security incidents regardless of their operational sector. Residents should maintain heightened vigilance regarding personal information following any notification of a data security lapse.