Origin Energy, a major Australian energy retailer, has confirmed a data breach that exposed personally identifiable information (PII) of some of its 4.8 million customers. The company, which provides electricity, natural gas, and broadband internet services, is currently investigating the full scope of the incident to notify affected individuals.
The exposed data types include full names, physical addresses, dates of birth, phone numbers, and account information. Origin Energy also stated that the last four digits of credit card numbers and the last three digits of bank account numbers were potentially exposed. However, the company emphasized that these financial details are incomplete and insufficient to facilitate account hijacking or unauthorized transactions.
Origin Energy CEO Frank Calabria issued an apology to customers and assured them that the company is implementing measures to prevent further unauthorized access. Affected customers will be contacted directly and offered support through a dedicated portal and resources.
The company has reported the incident to the Australian Federal Police (AFP), the Australian Cyber Security Centre, and the Office of the Australian Information Commissioner, and is collaborating with these agencies.
Prior to Origin Energy's second public statement confirming the breach, an individual identifying as "John Doe" contacted a local media outlet, claiming responsibility for the attack. This threat actor alleged to possess data belonging to 2 million Origin customers. The hacker claimed to have attempted to contact Origin's security teams, customer support, and even board executives without receiving a response. The threat actor has established a website and threatened to leak the stolen data within two weeks unless Origin initiates contact via Signal to negotiate a resolution.
