Personal and banking details among customer data stolen in Origin Energy hack

Hackers access Australian customers’ names, addresses, dates of birth, phone numbers and some bank account details, company says

Published 23 July 2026 645 words
TECHNOLOGY C1
Personal and banking details among customer data stolen in Origin Energy hack

Origin Energy has confirmed that personal information and some bank account details of its Australian customers have been accessed in a cyberattack. The company, which provides electricity, gas, and internet services to 4.8 million customer accounts across Australia, is working to determine the exact number of customers affected.

In a statement, Origin announced it would notify customers directly once it has confirmed whether their specific data was compromised. While the full extent of the breach is still under investigation, there are unverified claims from an individual claiming to be the hacker suggesting that details from as many as 2 million customers may have been accessed.

The company stated that the compromised data could include customer names, addresses, dates of birth, phone numbers, and Origin account information. It also mentioned that the last four digits of some credit card numbers, or the last three digits of some bank account numbers, might have been exposed. However, Origin assured that incomplete credit card or bank account information obtained in this breach cannot be used to make purchases or gain access to accounts.

Origin initially reported the incident on the previous day, initially stating that it believed credit card or bank details had not been accessed. The cause of the hack has not yet been explained by the company. Origin’s chief executive, Frank Calabria, expressed his apologies to customers, acknowledging their trust in the company to protect their information and regretting the potential impact of the incident.

Calabria stated that Origin is actively securing its systems to prevent any further unauthorised access and is collaborating with specialist cybersecurity experts and official authorities. He assured customers that the company is taking all necessary steps to address the situation and protect their data.

Cybersecurity experts have cautioned that the leaked personal information could make customers vulnerable. They warn that the data might be misused for identity theft or by scammers who could impersonate legitimate companies to trick individuals. Rumpa Dasgupta, a cybersecurity lecturer at La Trobe University, highlighted that such detailed personal records could be exploited not only for highly targeted phishing attempts but also to facilitate physical crimes, such as burglaries, by identifying potentially vulnerable properties.

The incident is currently under investigation by several official bodies, including the Australian Cyber Security Centre, the Australian federal police, and the Office of the Australian Information Commissioner (OIAC). The National Office of Cyber Security is coordinating the government's response to the breach. The OIAC reported a significant increase in data breach notifications in 2025, with a large portion linked to malicious activities, indicating a broader trend of cybersecurity challenges.

Vocabulary

cyberattack — An attempt to damage, disrupt, or gain unauthorised access to computer systems or networks.
compromised — Gained unauthorised access to or control of something, especially data or a computer system.
unverified claims — Statements or assertions that have not been proven to be true.
unauthorised access — Gaining entry or permission to view or use something without official permission.
vulnerable — Susceptible to physical or emotional attack or harm; easily damaged or harmed.
identity theft — The fraudulent acquisition and use of a person's private identifying information, usually for financial gain.
phishing campaigns — Attempts to trick people into revealing personal information (like passwords or credit card numbers) by pretending to be a trustworthy entity in an electronic communication.
facilitate — To make an action or process easier.
coordinating — Bringing the different elements of a complex activity or organisation into a position of effective action.
malicious activities — Actions intended to harm or disrupt computer systems or networks, often involving illegal or unethical behaviour.

Discussion Questions

  1. What specific types of personal information were compromised in the Origin Energy hack, and what limitations were stated regarding the compromised banking and credit card details?
  2. What are the potential risks for Origin Energy customers whose data was accessed, according to cybersecurity experts?
  3. Which government agencies are involved in investigating the Origin Energy data breach, and what does this indicate about the seriousness of the incident?

Based on an article from The Guardian.

Read the original article