Data Breach Hits Operator of South Texas Nuclear Power Plant

The nonprofit that runs the South Texas Project Electric Generating Station informed the state that it had sustained a data security incident exposing the information of nearly 1,200 residents.

(TNS) — A data breach has hit the operator of a South Texas nuclear power plant partially owned by CPS Energy and Austin Energy.

STP Nuclear Operating Co., a nonprofit that runs the South Texas Project Electric Generating Station near Bay City, notified the state attorney general’s office that it had a data security incident that affected nearly 1,200 Texans.

Data compromised in the breach includes names, Social Security numbers, birthdates and other personal information, according to the posting on the attorney general’s website. It said affected individuals were notified by email.

The notice did not indicate if the breach also affected the plant’s operating or safety systems, but a Nuclear Regulatory Commission spokeswoman said the agency “remains satisfied that the South Texas Project plant continues operating safely and securely in accordance with agency requirements.” She referred further questions back to STP.

CPS, Austin Energy and Constellation South Texas LLC own the 35-year-old facility, which has two reactors and can produce 2.7 gigawatts, enough to power 2 million homes. They oversee the nonprofit company and appoint its board members.

CPS, Austin Energy, Constellation and STP have not responded to queries what happened, their responses to the incident or who was affected.

Critical infrastructure operators such as STP are required to report certain cyber incidents to the Texas Cyber Command, which is in San Antonio. The command has not responded to a request for .

Last October, undisclosed security concerns from the Matagorda County Sheriff’s Office prompted STP to declare an “unusual event” at the plant. The status is the lowest of four emergency classifications used by the Nuclear Regulatory Commission, according to STP. It indicates situations that pose no threat to the public.

Another “unusual event” occurred in July 2024 when a loss of off-site power and a fire in the plant’s switchyard forced one of the facility’s two nuclear reactors to go offline.

Texas law requires businesses and organizations to report data breaches affecting 250 or more Texans to the attorney general’s office within 30 days after discovery. They also must provide notice of the breach to affected consumers.

The current list shows 686 notices with 573 filed this year and the rest from 2025. State law requires the AG to remove notices after a year if the organization has not reported another breach.

2026 the San Antonio Express-News, Distributed by