STP Nuclear Data Breach Hits 1,173 Texans [2026] - shattered.io

The operator of the South Texas nuclear power plant, STP Nuclear Operating Company, disclosed a data security incident to the state of Texas this week.

The filing with the Texas Attorney General on October 28, 2026, identified 1,173 Texas residents whose personal information was exposed in the breach.

The exposed data includes names, Social Security numbers, birthdates, and other personal details, according to a report by GovTech on October 30.

Details of the Exposed Information

The specific information affected by the incident is limited in the public record, with GovTech listing four confirmed categories: names, Social Security numbers, birthdates, and other personal information.

A site tracking breach filings for class action firms, ClaimDepot, lists a broader set of categories, including addresses, government IDs, medical information, and financial information.

However, the broader list from ClaimDepot appears to be a generic menu of possible categories, and the operator has not confirmed whether medical or financial data were involved.

Scope and Timeline

The filing counts only Texas residents, though the operator may have notified people in other states as well, as ClaimDepot tracks disclosures in a dozen other states.

The precise figure in the STP filing is 1,173, a number that GovTech rounds to nearly 1,200, though the operator has not clarified the exact population affected.

The public record does not state when the intrusion occurred or when STP Nuclear Operating Company discovered it, with the filing date being the only hard date available.

Impact on Plant Operations

The operator has not indicated whether the incident affected the plant’s operating or safety systems, a key distinction for nuclear facilities.

The Nuclear Regulatory Commission, through a spokeswoman, said the agency remains satisfied that the plant continues to operate safely and securely under agency requirements.

The regulator’s statement addresses plant safety but does not describe the breach or confirm that regulators reviewed the affected systems.

Next Steps and Open Questions

The absence of any attacker attribution or root cause in the public notice means this story should not be read as a ransomware event or a state-sponsored operation.

The most likely explanation is a breach of corporate IT systems, such as an HR database or email system, rather than plant control systems.

Affected individuals are advised to check their email for a notice from STP Nuclear Operating Company and to monitor their financial accounts for suspicious activity.