Origin Energy has opened an urgent investigation into a possible security incident that may have exposed some customer information, the Australian energy retailer said on Wednesday. The company has alerted federal authorities and said it is treating the matter with priority, while acknowledging the uncertainty such an incident can cause for its millions of customers.
What Origin has disclosed
In a brief statement, Origin Energy said it was investigating a potential unauthorised access to some customers’ data. The company added that it does not believe customer credit card or bank account details are among the information impacted. Origin also said it understands the situation may raise concerns and that it will provide further updates as its enquiries progress.
Origin notified the Australian Cyber Security Centre (ACSC) and the Australian Federal Police (AFP) after the company became aware of the potential breach, according to the statement and subsequent reporting.
Claims of a leaked sample and verification
Australian reporters said a hacker had sent a sample of about 50 customer records containing names, addresses, emails, dates of birth, phone numbers and bill history. The ABC stated it could not immediately verify those claims. Following those media reports, Origin informed authorities of the possible security incident.
The company did not publish a detailed list of what may have been accessed, nor did it make available the claimed sample. Origin’s public comments focused on the scope being under investigation and on reassuring customers that financial account details were not believed to be involved.
Scale and market response
Origin Energy is one of Australia’s largest energy retailers, serving more than 4.7 million customers. The announcement of an investigation into a potential data incident prompted a market reaction: shares in Origin fell about 1.88% on the day the company disclosed the probe.
Beyond immediate share-price movement, the disclosure prompted questions about the security posture of major service providers and the speed at which companies report suspected incidents to customers and regulators.
Context: a string of high-profile breaches
The possible Origin incident comes amid heightened focus on cybersecurity in Australia following a number of high-profile breaches in recent years. The ABC noted the 2022 mass breaches affecting Optus and Medibank, which brought scrutiny to how companies protect and respond to the theft of personal information.
More recently, last week a network of GP clinics operated by Partnered Health reported being targeted in a cyber attack that reportedly resulted in the theft of sensitive medical records and personal information. Those incidents have driven attention from regulators, journalists and consumer advocates on how organisations manage and disclose cyber incidents.
Authorities notified and investigatory steps
Origin’s notification to the ACSC and the AFP follows standard protocol for organisations that suspect they may have experienced a cyber intrusion. These agencies can provide technical and investigative support and co-ordinate any broader law enforcement response where criminal activity is suspected.
The company said its investigations are being conducted as a matter of urgency, and that it will provide further updates as appropriate. The ACSC and AFP notifications indicate the matter is being treated with the formal involvement of national cyber and policing agencies.
What this means for customers and the sector
At this stage, Origin’s statement and the reporting around a claimed sample leave key questions unanswered about the scale and nature of any compromise. The company’s assertion that payment card and bank details are not believed to be impacted may offer some reassurance, but customers and industry observers will be watching for more definitive findings from Origin’s investigation and any guidance from authorities.
The episode reinforces the persistent risk of data incidents for large service providers that hold significant volumes of personal information. It also underscores the importance of clear, timely disclosure when potential breaches arise, both to inform affected individuals and to allow regulators to assess any broader consumer protection implications.
Origin has not released a timetable for concluding its investigation. The company’s next public updates will be closely watched by customers, investors and regulators as they seek clarity on what information may have been accessed and what remedial actions Origin will take.
Source: ABC News & Headlines – Australian Broadcasting Corporation