Origin Energy

On July 2, 2026, Origin Energy received emails from an individual claiming to have accessed customer records. The company assessed the claim and did not initially consider it credible, because there was no evidence confirming customer data had been accessed. On July 22, the sender provided proof. Origin announced it was investigating a potential security incident on July 23.

On July 28, Origin confirmed that approximately 900,000 current and former customers had data accessed and exfiltrated. Origin is Australia's largest energy retailer. The company notified the Australian Cyber Security Centre, the Australian Federal Police, and the Office of the Australian Information Commissioner.

Confirmed exposed: names, addresses, dates of birth, phone numbers, account details, and partial payment information — specifically the last four digits of credit cards, or the BSB and last three digits of bank accounts. Origin has stated it does not believe full credit card or bank account details were included.

The partial payment data deserves attention rather than relief. A BSB identifies the specific branch of a specific Australian bank. Combined with a name, address, date of birth, and the last three digits of the account, it gives a caller enough to pass identity verification at that institution — without ever holding the full account number.

900,000 Australian households, including former customers who ended their relationship with Origin years ago and had no reason to think the company still held their details.

Name, address, date of birth, and phone number is the standard identity verification set used by Australian banks, telcos, and government services. The immediate risk is not card fraud — it is social engineering and SIM-swap attempts against people whose verification answers are now known. Energy account data compounds it: a service address confirms current residency, which is precisely what a fraudulent credit application needs. Origin customers should expect targeted phishing that correctly cites their account details, because the attacker has them.

Origin did what a mature security function is supposed to do with an unverified extortion email: it investigated rather than panicking. Extortion claims against large consumer brands are constant, and most are bluffs recycled from old datasets. Announcing a breach on the strength of an unsubstantiated email is its own harm.

So the company looked at its systems and found no evidence of unauthorised access. That conclusion was reached in good faith. The problem is what "no evidence" means when you cannot fully enumerate what data existed or who touched it — it collapses into "we could not tell either way," which is a very different finding, and it does not read that way in a briefing.

For twenty days, an attacker knew more about Origin's customer data than Origin did. The gap did not close through internal investigation. It closed when the attacker chose to prove it, on the attacker's schedule.

The presence of former customers in the exposed population points at the same underlying issue. 900,000 records including people who left implies retention beyond the active customer base — data held because deleting it was never anybody's project, sitting in systems whose contents had not been enumerated recently enough to check a claim against.

Origin's July 2 assessment was not wrong about the evidence. It was constrained by a data map that could not answer the question being asked.

Australia's Notifiable Data Breaches scheme requires an entity to assess a suspected eligible breach within 30 days and notify the OAIC and affected individuals as soon as practicable once serious harm is likely. Origin's timeline runs 26 days from the first email on July 2 to confirmed scope on July 28 — inside the assessment window, but consumed almost entirely by determining whether there was anything to assess.

Because the exposure includes former customers, Origin must notify people who are no longer reachable through active account channels. Contact details on file for someone who left in 2019 are frequently stale, which turns notification into a records exercise before it becomes a mailing exercise. Involvement of the ACSC and AFP is standard for an incident of this scale; the OAIC engagement is where the regulatory consequence, if any, will surface.