Origin Energy cyber security warning follows big data breach
Key takeaways
- Origin Energy's chair warned of a growing cyber threat at the annual meeting.
- Hackers stole data from about 900,000 current and former customers in a July breach.
- Origin has seen no proof that stolen data reached the dark web.
Origin Energy's chair warned of a growing cyber threat. He spoke at the firm's annual meeting in Sydney on Wednesday. The warning came months after a major data breach hit the firm.
Scott Perkins chairs Origin Energy. He told shareholders that cyber crime keeps growing. He said people and firms around the world face this threat.
Search interest in Australia jumped after the meeting. Google Trends showed about 10,000 searches for the warning.
Perkins also gave an update on the breach. He said Origin has seen no proof that stolen data reached the dark web. The dark web is a hidden part of the internet.
Criminals can buy and sell stolen data there. Perkins said the risk still stands. He urged affected customers to stay alert for scams.
What happened
Hackers broke into Origin Energy customer data in July 2026. Origin is Australia's largest energy retailer. It has about 4.8 million customer accounts. The breach hit about 900,000 current and former customers.
The stolen data included names and home addresses. It also included dates of birth and phone numbers. Account details were in the mix too.
For most people, only part of a card or bank number was taken. That meant the last four digits of a credit card. Or it meant the last three digits of a bank account.
A small group faced a worse hit. Up to 60 full bank account numbers were taken. Around 100 ID document numbers were also taken.
Origin said most affected people were former customers. It also said partial card and bank details cannot buy goods. It said those partial details cannot open customer accounts.
The timeline drew sharp criticism. Origin got emails on July 2 from a person who claimed to hold customer records. The firm did not treat the claim as credible at first.
It said it had no proof that data had been taken. Proof arrived on July 22. Origin then told the public and its customers.
Chief executive Frank Calabria later said sorry to customers. He said Origin would support the people hit by the breach. He also said the firm had taken steps to lock down its systems.
Calabria did not talk about the breach in his speech to shareholders. He spoke instead about the shift to cleaner energy. He also spoke about gas and power market reforms.
Perkins used his own speech to face the breach head on. He said Origin had worked to support hit customers. He said the firm had taken steps to stop a repeat.
He also said the firm had seen no sign of the data on the internet. That includes the dark web. But he warned that the risk has not gone away.
Investigators are still looking into the breach. Origin told police and cyber officials about it. The firm told the Australian Cyber Security Centre.
It also told the Australian Federal Police. It told the privacy watchdog too. Calabria said the firm cannot share more detail now.
He said the case is a live criminal matter.
According to ESD News, the attack was traced to a third-party call centre. The centre was run by Accenture in Manila. Origin has not blamed any named group in public.
This article makes no claim about who carried out the attack.
Why it matters
A breach of this size puts many people at risk of scams. Stolen names and phone numbers help criminals sound real. A fake call can look like it comes from Origin.
A fake text can ask a person to click a link. That link can lead to a trap. Scammers use such tricks to steal money or passwords.
The risk is real even when full bank details stay safe. Most victims lost only partial card or bank digits. But scammers can pair small facts to build trust.
A date of birth plus an address can make a scam feel true. That is why Origin urges care with strange calls and texts.
Energy firms are prime targets for attackers. A new report from Nozomi Networks Labs backs this up. It found Australia is now the most targeted country.
The attacks hit smart devices and factory systems. Australia was third in the last report. The energy, utilities, and waste sector now ranks third among hit industries.
It moved up past the government sector.
Other recent cyberattacks show the same pattern. Attackers hit firms that hold big stores of customer data. A cyberattack that hit French supermarkets showed how a breach can reach daily life.
A cyberattack on London fashion brands showed that no sector is safe. The lesson is plain. Any firm that holds personal data can become a target.
The breach also tests trust. Origin is the biggest energy retailer in Australia. Millions of people trust it with their bills and details.
A breach of 900,000 records shakes that trust. How the firm reacts now will shape how customers see it. Clear updates and real support can help rebuild trust.
What happens next
Origin says it will keep watching for leaked data. It monitors the internet and the dark web. If stolen data shows up, the firm will need to act fast.
Affected customers should also watch their own accounts. They should look for strange calls, texts, and emails.
Origin shared plain steps for customers. Be careful with surprise calls about your Origin account. Do not click links in messages you did not ask for.
Check the caller through official channels first. Never share passwords with anyone. Do not share bank details unless you are sure who you are dealing with.
Two-step checks add a second lock to an account. They ask for a code as well as a password. Origin urges customers to turn this on for email and other services.
Two-step checks can still fail if attackers trick users. So care with links and calls still counts.
Affected customers can call Origin on +61 8 9922 7000. The firm set up a dedicated support line. It also offers specialist identity and cyber support. Customers should use official Origin channels only.
They should not trust a number from a random text.
Watch for more news in the weeks ahead. Police and cyber officials are still probing the case. Origin may share more facts once the probe allows it.
The firm may also face questions about its slow first response. For now, the key fact stands. The data has not surfaced in public.
But the risk of scams stays high.
Related stories
Apple plans two October launches: smart home hub, OLED MacBook Pro
Apple set October 13 for a smart home launch with a new hub, Apple TV 4K and HomePod mini, then October 27 for OLED MacBook Pro models
How to Check If Your Phone Supports eSIM in 30 Seconds
Dial *#06# and look for an EID number to confirm eSIM support in under 30 seconds. This guide also walks through the iPhone and Android
eSIM vs iSIM: what is the difference?
An eSIM is a dedicated chip on the phone's board, while an iSIM lives inside the processor itself. Qualcomm's Snapdragon 8 Gen