Origin Energy confirms customer data breach after hacker claims access

Origin Energy confirmed on 23 July 2026 that some customers’ data had been accessed and disclosed, after an earlier probe into a potential security incident triggered alarm over the safety of millions of utility accounts. The company said it was still working to determine how many customers were affected and would contact people it could confirm had been impacted.

The data Origin said may have been exposed includes names, addresses, dates of birth, contact phone numbers and account information. Later information indicated that partial credit card and bank account numbers may also have been involved for some customers, a sharper turn from Origin’s initial position that it did not believe financial details had been affected. The shift raises the stakes for customers whose records may now be circulating outside the company’s systems.

The breach matters because Origin is Australia’s largest electricity and gas retailer, with reporting putting its customer base at roughly 4.7 million to 4.8 million accounts. An alleged hacker, using the name John Doe, had claimed access to customer information and said warning emails had been ignored for weeks. The same claims suggested as many as 2 million customer records may have been compromised, a figure that helped drive public concern before Origin’s confirmation.

Energy retailers sit on a large store of personal and payment-related information, and that makes them attractive targets for criminals seeking identities, account access and material for phishing or fraud. Even where only partial financial data is exposed, names, addresses and account numbers can be enough to help scammers build convincing approaches that look routine to customers of a trusted household brand. For an essential service provider, the damage is not only about privacy but also about confidence in billing, payments and customer service systems that households and businesses rely on every day.

Origin said it had notified the Australian Cyber Security Centre and the Australian Federal Police about the potential incident. The company’s disclosure now places pressure on its security controls, its incident-response timing and the broader standard for how quickly large corporations tell customers when personal data may have left their systems. In a year when cyber incidents have kept hitting major businesses across sectors, the handling of this breach will be closely watched for what it says about corporate accountability and the pace of disclosure.