South Texas Project Operator Reports 1,175-Person Breach — NRC Says Plant Keeps Running

The San Antonio Express-News reported that STP Nuclear Operating Company — the nonprofit that runs the South Texas Project Electric Generating Station near Bay City in Matagorda County — disclosed a data security incident to the Texas Attorney General. Third-party trackers summarize the filing as BR-0005459, posted October 28, 2026; we could not independently open the Express-News article (paywall) and treated the Texas OAG breach portal plus BreachRecord’s filing summary as the numeric source of truth below.

This is an employee / contractor / HR-class PII story on the corporate IT side, not a report that reactor safety or operating systems were compromised. Coverage citing the Nuclear Regulatory Commission says the plant continues operating safely and securely — we repeat only that high-level reassurance, not speculation about control systems.

STP Nuclear Operating Co. (stpegs.com) is owned by CPS Energy, Austin Energy, and Constellation South Texas LLC. The site has two reactors and about 2.7 GW of capacity. Critical-infrastructure operators in Texas also face separate Cyber Command reporting rules; this post stays on the AG consumer notice and what Texas small businesses, utilities, co-ops, local governments, law firms, and financial advisors should do when SSNs and dates of birth leak heading into tax season.

Snapshot

Texas law requires an AG report within 30 days when 250 or more Texans are affected — an educational timing rule, not a comment on STP’s compliance.

Who is at risk

Anyone in the 1,175-person notice pool — current or former employees, contractors, and others whose HR or benefits data sat in the affected environment. Names plus SSNs and DOBs are enough for tax-refund fraud, W-2 phishing, payroll-diversion scams, and synthetic identity builds, especially as 2026 tax season approaches.

Owners and neighbors are not automatically in the AG count unless they received their own letter. Plant output is a separate question from corporate PII; do not conflate them.

What to watch for

• Email “breach notice” messages that rush you to a link, attachment, or phone number you did not expect — real notices can be emailed, which makes fake ones easier.
• W-2 or 1099 mail that arrives early, asks you to “confirm payroll,” or redirects to a lookalike HR portal.
• IRS or SSA callbacks that already know your DOB because it was in this leak — government agencies do not cold-call for SSN verification.
• Direct deposit change forms supposedly from HR — verify through a known manager or typed intranet URL, not reply mail.

Is the breach email real?

1. Read the Texas OAG portal or call the number in your paper letter if one arrives — do not trust a link-only email.
2. Type stpegs.com yourself; compare any mailed URL to the company’s published contact paths.
3. Check whether the message passes DMARC in your client — pass proves the domain sent it, not that the body is safe (xAI invite class).
4. Forward suspect samples to your security team as attachments — not inline screenshots in public threads.

What to do

If you received an STP notice (or think you should have):

1. Enroll in credit monitoring only through instructions in your official letter — the public filing we read does not promise free monitoring.
2. Place a credit freeze at Equifax, Experian, and TransUnion — stronger than monitoring alone when SSNs were listed.
3. Request an IRS Identity Protection PIN if you are eligible — file taxes early when you have all forms.
4. Watch payroll and bank accounts for ACH changes; confirm direct deposit edits through HR channels you already use.
5. Report identity theft at IdentityTheft.gov and suspicious mail to IC3.

If you run IT for a Texas org:

• Enforce DMARC p=reject (or quarantine with reporting) so attackers cannot spoof your domain in fake “breach update” or payroll mail.
• Require phishing-resistant MFA (FIDO2 / YubiKey) on HR, payroll, finance, and executive mailboxes — not SMS alone.
• Review vendor and contractor access after any sibling utility incident; contractors often hold copies of the same PII.
• Document your cybersecurity program if you are an eligible Texas business evaluating SB 2610 with counsel — SB 2610 may help limit exemplary damages for eligible businesses that maintain a documented cybersecurity program; not legal advice or a guarantee.

MFA: YubiKey and Google Authenticator

Leaked SSNs are not fixed by MFA on your personal email — but HR/payroll takeover and fake breach portals are. Grades match our MFA directory.

Microsoft and Google document FIDO2 security keys and authenticator-app TOTP for admin and user sign-in (Microsoft security key help, Google 2-Step Verification). Credit-bureau freeze portals document authenticator-style options on consumer accounts — enroll before you need a rush freeze. my Social Security remains SMS-heavy in public docs — treat SSA callbacks as hostile. MFA on your mailbox does not rewind an STP HR leak.

Directory: MFA support directory · Category → Email & Identity and Business Apps.

Recommended MFA tools

We may earn a commission if you buy a YubiKey or sign up for Proton Pass through the links above.

Independent cybersecurity audits

We audited STP, its owner utilities, and Constellation on October 30, 2026. 100% is the ideal — none reach it. These scores are public email / transport / website posture. They do not prove or disprove the Sep 28–29 incident.

Audit links: stpegs.com · cpsenergy.com · austinenergy.com · constellationenergy.com

An older NASDAQ-100 scoreboard snapshot showed constellationenergy.com around 30% overall — a different date; use today’s links for owner-brand mail risk. Shared 15% Transport on all four hosts means MTA-STS enforcement gaps — relevant when email breach notices go out.

Blacklist and lookalike domains

Email blacklist checks (public DoH, October 30, 2026): stpegs.com, cpsenergy.com, austinenergy.com, and constellationenergy.com were clear on mail/domain lists we can query. SPFBL notes on STP and Constellation web/CDN IPs are informational — not mail-reputation hits.

DNS lookalike scans (BEC profile, registered signals only):

High-interest registered names (investigate; not proof this breach used them):

Type stpegs.com, cpsenergy.com, and austinenergy.com yourself. Continuous monitoring: Cybersquat Domain Monitoring.

Related coverage

• MFA support directory
• Government & education breach tracker
• Texas OAG breach reports YTD
• Texas Cyber Command / Cyber Ready
• Clover Health social engineering
• McKesson vishing lawsuits
• TRICARE phishing PSA (JBSA)
• DHS Icepick directory leak
• Minnesota water utilities OT incident

Check your domain free at audit.emailmenow.com, or see automated reports and monitoring.

Sources: San Antonio Express-News (paywall at probe time) · Texas OAG — Data Security Breach Reports · BreachRecord STP summary · STP Nuclear Operating Co. · NRC / plant-safety characterizations as reported in Express-News and wire coverage (no control-system compromise indicated). Independent EmailMeNow audits, blacklist, and cybersquat probes October 30, 2026. Website-tech probes skipped (WEBSITE_TECH_PROBE_KEY not available in this environment). Domain scores: audit.emailmenow.com only.

SB 2610 may help limit exemplary damages for eligible businesses that maintain a documented cybersecurity program; not legal advice or a guarantee.