Origin Energy confirms breach after hacker claims
Australia’s largest electricity and gas retailer, Origin Energy, has confirmed that customer data was compromised in a security incident. The company, which serves nearly 5 million customers across the country, initially said on Wednesday it was investigating a ‘potential security incident’ after The Australian reported that a hacker had shared what they claimed was a sample of stolen records.
By Thursday, the Sydney-based energy giant issued a second update. The tone shifted. It was no longer a possibility — it was a confirmed breach. Origin said it is now working with federal agencies and independent cyber experts to understand the full scope of the attack.
What data was stolen in the Origin Energy cyberattack?
The stolen data includes names, addresses, dates of birth, and account information. More concerning for many customers: the breach also exposed the last four digits of credit card numbers and the last three digits of bank account numbers.
Origin has not yet said how many customers are affected. The company said it is ‘working to understand the total number of impacted customers.’ That investigation is ongoing.
For now, the company recommends customers monitor their accounts for suspicious activity. If you’re an Origin customer, it’s worth checking your bank statements and credit card transactions more closely than usual.
CEO Frank Calabria apologizes, promises action
Origin CEO Frank Calabria issued a public apology. ‘One of our key priorities is taking action to secure our systems and ensure no further unauthorised access,’ he said in a statement. ‘We are working with independent cyber experts to support Origin, and that work is continuing alongside the work of authorities.’
Calabria did not provide a timeline for when the investigation might conclude. He also did not say whether the company plans to offer credit monitoring or identity theft protection to affected customers — something that has become standard practice after major breaches in other countries.
A worrying pattern: Australian healthcare data also hit
This breach comes on the heels of another major Australian cyberattack. Partnered Health, a network of healthcare clinics, recently confirmed that patient medical records were stolen from at least 21 clinics. The two incidents — one targeting energy, the other healthcare — suggest Australian critical infrastructure is facing a sustained wave of attacks.
It’s a troubling pattern. In 2022, Optus suffered a massive breach affecting 9 million customers. Then came Medibank, which exposed the health data of millions. Now Origin Energy. The question isn’t whether another major Australian company will be hit — it’s which one, and when.
Energy companies are particularly attractive targets. They hold vast amounts of personal and financial data. They also operate systems that are critical to national infrastructure. A breach at an energy retailer isn’t just about stolen credit card numbers. It raises questions about grid security, operational technology, and the potential for more disruptive attacks.
What Origin customers should do right now
- Check your account activity — log in to your Origin Energy account and look for any changes you didn’t make.
- Monitor financial statements — watch for unauthorized transactions on credit cards and bank accounts.
- Be alert for phishing — scammers often piggyback on data breaches with fake emails or calls pretending to be from the company.
- Consider a credit ban — if you’re worried about identity theft, you can place a temporary ban on your credit file through agencies like Equifax or Experian.
Origin has not yet announced whether it will provide free credit monitoring services. In previous Australian breaches — like the Optus incident — the government eventually stepped in to mandate such protections. It may happen again.
The bigger picture: Australian cybersecurity under strain
The Origin Energy data breach is the latest in a string of high-profile cyberattacks hitting Australian companies. The government has responded by strengthening data breach notification laws and increasing penalties for companies that fail to protect customer data. But enforcement takes time. Meanwhile, hackers keep finding new ways in.
For energy companies, the stakes are especially high. A compromised customer database is bad enough. But if attackers were to pivot from IT systems to operational technology — the systems that actually control power generation and distribution — the consequences could be far more severe.
For now, Origin Energy customers are left waiting. Waiting for answers. Waiting to find out if their data was stolen. Waiting to see if the company will do more than apologize.
