Communication plays a vital role in incorporating smartness into the interconnected power system. However, historical records prove that the data transfer has always been vulnerable to cyber-attacks. Unless these cyber-attacks are identified and cordoned off, they may lead to black-out and result in national security issues. This paper proposes an optimal two-stage Kalman filter (OTS-KF) for simultaneous state and cyber-attack estimation in automatic generation control (AGC) system. Biases/cyber-attacks are modeled as unknown inputs in the AGC dynamics. Five types of cyber-attacks, i.e., false data injection (FDI), data replay attack, denial of service (DoS), scaling, and ramp attacks, are injected into the measurements and estimated using OTS-KF. As the load variations of each area are seldom available, OTS-KF is reformulated to estimate the states and outliers along with the load variations of the system. The proposed technique is validated on the benchmark two-area, three-area, and five-area power system models. The simulation results under various test conditions demonstrate the efficacy of the proposed filter.