Origin Energy confirms hack exposed customer identity and bank data

Origin Energy has confirmed that hackers accessed personal information belonging to some customers, including names, addresses, dates of birth, phone numbers and partial bank account details. The disclosure raises fresh concerns about the exposure of sensitive customer records at one of Australia’s largest energy and broadband providers. Origin says it has 4.8 million customer accounts across electricity, natural gas, LPG and internet services, though the company has not said how many people were affected in this incident. At this stage, the publicly available details remain limited. The company has confirmed the categories of data accessed, but it has not yet released a full account of how the breach happened, whether the stolen information has been misused, or whether the incident affected active accounts, past customers, or both. Those are critical questions for customers deciding what steps to take next. The inclusion of partial bank account details makes the breach especially sensitive. Even incomplete financial information can be useful to scammers when combined with names, contact details and dates of birth. Security experts commonly warn that stolen personal data can be used in phishing attempts, identity theft, account takeover scams and highly targeted fraud. For customers, the immediate concern is not only what was taken, but what might happen next. People who receive suspicious emails, text messages or phone calls claiming to be from Origin Energy or a bank should be cautious, especially if the message asks for passwords, verification codes or payment details. Customers should also be alert to unexpected account activity and monitor financial statements closely. Origin’s customer base is broad, covering households and businesses as well as energy and internet services. That scale means even a breach affecting a relatively small slice of accounts can still have a wide impact in terms of alerting customers, handling support calls and managing the risk of fraud. The incident also adds to the broader pressure on Australian companies to improve cyber defences and data handling practices. Energy and utility providers hold large volumes of personal information, making them attractive targets for attackers. Once a breach occurs, the focus quickly shifts to containment, notification, and whether enough safeguards were in place to limit the damage. What remains unclear is whether Origin has identified the method used by the hackers, whether any third-party systems were involved, and when customers can expect more detailed notifications. Companies in this position often need time to assess the scope of access before they can provide a complete picture, but the early confirmation that identity and banking-related data were exposed will be enough to worry many customers. For now, the key takeaway is straightforward: Origin Energy says some customer data has been accessed in a hack, and the information involved is serious enough to warrant caution. Customers should treat unsolicited contact carefully and watch for signs that their personal or financial information is being used without permission.

Source: The Guardian Technology - https://www.theguardian.com/australia-news/2026/jul/23/personal-and-banking-details-among-customer-data-stolen-in-origin-energy-hack