Detection of unauthorised access to Origin Energy customer data

During July 2026, Origin Energy detected signs of a possible cybersecurity incident involving unauthorised access to customer information. The company subsequently stated that it had been investigating a potential threat since early July, although the information available at the time did not allow it to be considered credible. On 22 July, after receiving new information suggesting that the incident may have occurred, the company activated its response, launched a formal investigation and notified the relevant authorities.

The company confirmed that the compromised information could include names, addresses, dates of birth, telephone numbers, customer account details and the last few digits of bank cards or bank accounts, specifying that this partial data did not allow payments to be made or financial accounts to be accessed. Subsequently, on 28 July, the company reported that the initial phase of its review estimated that approximately 900,000 current and former customers had been affected. In response, Origin began contacting those affected directly, set up dedicated helplines, offered specialist identity protection and cybersecurity support services, engaged independent forensic and security experts, strengthened the security of its systems, and maintained coordination with the Australian Cyber Security Centre, the Australian Federal Police and the Office of the Australian Information Commissioner.

The incident is currently still under investigation and Origin Energy’s response to the incident remains ongoing. According to the most recent official information, the company has completed the initial phase of its review to determine the extent of the data breach and is continuing to notify affected individuals individually, whilst keeping the support and protection services offered following the incident available.