Origin Energy Confirms Data Breach Affected 900,000 Australian Customers

Origin Energy Limited, one of Australia’s largest energy retailers, said on July 28, 2026 that the initial phase of its investigation into a data security incident had identified approximately 900,000 current and former customers whose information was accessed. The figure follows Origin’s first public confirmation of unauthorized access on July 23, and it lands well below the 2 million customers a hacker claimed to have stolen.

What Origin Energy Confirmed

In a statement posted to its investor and media page, Origin CEO Frank Calabria said the company had “completed the initial phase” of its review and that “at this point in time, we believe the information of approximately 900,000 current and former customers was accessed.” For those customers, the exposed data may include full name, address, date of birth, phone number, and account information, along with the last four digits of a credit card number or the last three digits of a bank account number. Origin says this partial financial data is incomplete and cannot on its own be used to make purchases or access accounts.

The company traces the incident back to early July, when it began reviewing what it called a “potential security threat” but did not initially assess as credible. New information on July 22 changed that assessment, prompting Origin to notify the market and customers as a precaution. A day later, Origin’s first public update confirmed there had been “unauthorised access and disclosure of some customers’ data,” though at that point the company had not yet determined how many people were affected.

A Hacker’s Higher Number, and an Unconfirmed Deal

The scale of the breach became public before Origin’s own confirmation of a customer count. According to BleepingComputer, a threat actor using the name “John Doe” contacted Australian outlet 7news claiming to hold data belonging to 2 million Origin customers, more than double the figure Origin has since confirmed. The hacker said they had tried reaching Origin’s security team, customer support, and board executives without a response, then set up a leak site threatening to publish the stolen data within two weeks unless Origin negotiated a resolution over Signal.

SecurityWeek later reported that the same hacker told The Australian, in a paywalled report, that an agreement had been reached with Origin and that no data would be released. Origin has not confirmed any such agreement. Calabria described the incident as “a criminal matter that is subject to an ongoing investigation by the relevant authorities” and said the company is “constrained by the level of information” it can share while that investigation continues.

Origin’s Response and Advice to Customers

Origin says it is contacting affected customers directly, has extended its customer support hours, and has set up a dedicated contact line and email address alongside specialist identity and cyber support services. The company says it is working with outside cybersecurity and forensic specialists and has taken steps to secure its systems against further unauthorized access.

Origin has also engaged multiple Australian government bodies over the incident, including the Australian Cyber Security Centre, the National Office of Cyber Security, and the Australian Federal Police, and has notified the Office of the Australian Information Commissioner. The company is urging customers to watch for scams that could exploit the breach, including callers or messages impersonating Origin, and recommends verifying any contact independently, never sharing account passwords, and enabling two-step authentication on email and other online accounts.

Origin’s Scale, and What Comes Next

Origin serves roughly 4.8 million electricity, gas, and broadband customers and is listed on the Australian Securities Exchange, making it one of the country’s largest energy retailers. Utilities occupy an unusual position in the data-breach landscape: customers cannot easily switch away from essential services the way they might cancel a retail account, and the billing systems that make outages and payments convenient also concentrate names, addresses, dates of birth, and partial financial details in one place. That combination, along with Origin’s customer base, may help explain why this breach quickly turned into a ransom-style extortion attempt rather than a quieter data sale, and why the gap between a hacker’s claimed haul and a company’s confirmed total, 2 million claimed versus 900,000 confirmed here, has become a familiar pattern in how these incidents play out publicly before an investigation is finished. Origin says its review is continuing, with further updates expected on its investor and media page.