https://www.abc.net.au/news/2026-07-28/origin-energy-data-breach-900k-customers-impacted/106961804
Australian energy provider Origin Energy has confirmed that the personal data of approximately 900,000 current and former customers was accessed in a recent data security breach, with chief executive Frank Calabria issuing a public apology and stating that affected customers would be directly contacted. The company first became aware of a potential security threat in early July but assessed it as not credible based on available information at the time. On 22 July, new information emerged indicating a security incident had likely occurred, prompting Origin to notify the market and send precautionary communications to its broader customer base. The investigation is described as ongoing, with Origin working alongside cybersecurity and forensic specialists, government agencies, and other relevant bodies to contain the incident and secure its systems.
The breach drew additional scrutiny after Origin initially told the ASX that no financial details had been compromised, before walking back that statement the following day. The CEO defended the company’s handling of the disclosure, framing the updates as reflecting the progressive nature of a live investigation rather than missteps, though the sequence raised questions about the rigour of Origin’s initial assessment. An alleged hacker reportedly approached The Australian newspaper last week, providing a sample of 50 customer records containing names, addresses, emails, dates of birth, phone numbers, and billing history. The ABC subsequently spoke with someone claiming responsibility for the breach, who provided what they described as a sample from a larger customer dataset along with internal screenshots of Origin systems, though the ABC was unable to verify the authenticity of the material with Origin. The CEO described the matter as criminal and noted it was being investigated by the relevant authorities, citing those proceedings as a constraint on how much information the company could publicly disclose.