Origin Energy data breach investigation continues

In late July 2026 Origin Energy confirmed that an unauthorized intrusion into its customer‑management system occurred on 23 July, exposing personal details of an undisclosed number of its roughly 4.8 million household customers. The breach was disclosed via an ASX announcement on 24 July, reiterating media estimates that up to two million records – including names, addresses, dates of birth, contact numbers and partial payment information – may have been compromised. A former employee is alleged to have used internal Kraken‑supplied login credentials to gain access.

Australian authorities, including the Australian Cyber Security Centre and the Australian Federal Police, were notified. Security experts warned that the stolen data could facilitate targeted scams, especially as cyber‑criminals employ generative AI to craft highly personalised phishing attacks.

The Office of the Australian Information Commissioner (OAIC) reminded consumers of their rights under the Privacy Act 1988 and the Notifiable Data Breaches scheme, urging them to request details on data handling, encryption and retention. Customers have been advised to monitor financial accounts, enable extra authentication, and stay vigilant for suspicious communications.

Origin Energy continues to work with investigators and security specialists to contain the incident and prevent further misuse of the compromised data.