By Audrey Courty

Topic: Information and Communication

Fri 24 Jul 2026 at 5:04am

Origin Energy said some customers' data was accessed without permission.

In short:

Criminals can use stolen data to launch targeted scams and pretend to be victims.

Experts say AI makes it easier for scammers to combine leaked data with public information.

Customers should be careful of unexpected calls and messages from scammers.

Stolen data can be used to create convincing phishing emails, phone calls, and text messages.

The warning comes after Origin confirmed some customers' data was accessed without permission.

Origin is a big energy company with over 4.8 million customers.

The company is still working to find out how many people are affected.

While full payment card details were not stolen, experts say the information is still valuable.

Scams can pretend to help you.

Professor Richard Buckland says the greatest risk is scammers exploiting anxiety about the breach.

He advises customers to be alert but not alarmed and avoid clicking links in unsolicited emails.

Experts warn criminals can use stolen data to create convincing phishing messages.

Rahat Masood says criminals no longer need bank details to launch convincing attacks.

Phishing is a common scam in Australia, with scammers making millions of dollars.

Dr Masood says names, phone numbers, and home addresses can be used to create personalized phishing emails.

AI has made it easier for scammers to build detailed profiles of victims and generate personalized scam messages.

If scammers know your profile, they can send you a promising job link or pretend to be someone you trust.

Identity theft is a risk in the AI era.

Professor Daswin De Silva says the breach could allow criminals to impersonate customers and bypass identity checks.

The last four digits of a credit card can be used to verify someone's identity.

Criminals can use this information to launch impersonation attacks.

Many online retailers store customers' payment details, so criminals may only need enough information to satisfy identity checks.

You don't always need the full card number to make a transaction.

Some organizations authenticate customers using the last four digits of their credit card.

Richard Buckland says fraudulent Origin utility bills could be used as proof of identity.

The stolen information could be merged with data from previous breaches to build detailed profiles of victims.

Once this information is out there, it tends to stay out there.

Hackers have released personal data from Qantas customers onto the dark web.

Professor Buckland says one aspect of the breach that concerns him is Origin's ability to issue utility bills.

If there's enough information to make a bill look legitimate, people with disinformation could print bills that appear to come from Origin.

That counts for 20 points under Australia's 100-point identity check, so there's potentially slightly more risk of identity theft.

Dr Masood says AI has lowered the barrier for more sophisticated impersonation scams.

If you have a video online or you've spoken publicly, scammers can use five or 10 seconds of your voice and clone it.

They can then send a WhatsApp voice message or make a phone call pretending to be you.

How to protect yourself

All three cybersecurity experts say affected customers should remain cautious.

They recommend being careful of unexpected calls and messages.

See more ABC coverage in your search results

Practice Listening