Origin Energy has confirmed there was unauthorised access to and disclosure of some customers' data, in an update lodged with the Australian Securities Exchange (ASX). Yesterday, the energy retailer first flagged a "potential" security incident.
In the release, signed by company secretary Helen Hardy, Origin said it is still working to understand the total number of affected customers and will contact anyone it can confirm has been impacted. For those customers, the exposed data may include name, address, date of birth, contact phone number and account information, along with partial payment details like the last four digits of a credit card or the last three digits of a bank account. Origin said incomplete card or account numbers of that kind cannot be used to make purchases or access accounts.
Origin CEO Frank Calabria offered a direct apology in the statement.
"I'm sorry this has happened. Customers trust Origin with their information, and I apologise for the impact this may cause." He said the company is contacting affected customers, has set up a dedicated support line, and is "working with independent cyber experts" alongside government authorities to secure its systems against further unauthorised access.
Origin said it continues to engage with the Australian Cyber Security Centre (ACSC), the Australian Federal Police (AFP) and the Office of the Australian Information Commissioner (OAIC), the regulator that oversees Australia's Notifiable Data Breaches scheme.
Origin serves more than 4.8 million customers across electricity, gas, LPG and internet services, putting today's confirmation in the same scale bracket as the 2022 Optus and Medibank breaches. Both reshaped local cyber insurance pricing and produced significant class action activity. With partial financial data among the confirmed exposures, brokers advising corporate clients on cyber and management liability cover have a live, large-scale case study to point to on breach-response obligations, notification timing. There's also the reputational cost of moving from "potential" to "confirmed" in the space of 24 hours.
