Origin customers' bank and ID details stolen in breach

Cyber Crime

Origin Energy experienced a data breach in July. (ABC News: Darryl Torpy)

In short:

Origin Energy has completed its review of customer data accessed in July's data breach.

It has confirmed approximately 60 customers' full bank account numbers and 100 customers' ID document numbers were accessed.

What's next?

The criminal investigation into the data breach is ongoing.

Origin Energy says as many as 60 customers had their full bank account numbers accessed by a hacker in July.

Last month, Origin confirmed a major cybersecurity breach affecting approximately 900,000 current and former customers.

The company has also updated the public, saying that for those 900,000 customers affected by the July security breach, information accessed included some combination of name, address, date of birth, contact phone number, account and other information about the customers' personal circumstances, as well as the last four digits of a credit card, or the last three digits of a bank account.

The hacker, Origin has confirmed, also accessed "numbers associated with government concession scheme or program, affecting approximately 15,000 customers in total".

In addition, approximately 100 customers have had an "ID document number" accessed, stressing it was "the number only, no scanned copies of ID documents were affected".

The theft of names, addresses and phone numbers may seem less serious than stolen bank details, but cyber experts say AI is changing what criminals can do with that information.

"We have now confirmed the specific types of information that have been accessed on a customer-by-customer basis, and are well advanced in providing further specific notifications to each affected customer," the company said in a statement.

"Those specific customer notifications include details of the information that has been accessed, advice on the practical steps they can take and the various supports available."

The criminal investigation into the breach is still ongoing, Origin Energy CEO Frank Calabria said.

"We have substantially completed our review into the information accessed for each affected customer, and our priority is completing our notifications to them and providing support," he said in a statement.

He added that the company is working closely with the federal government, the Australian Cyber Security Centre, the National Office of Cyber Security and the Australian Federal Police.

The update from the energy company comes after authorities traced the cyber hack to a call centre in the Philippines, with the investigation linking the breach to a former Accenture employee in Manila.

Accenture works with Origin to run its call centres, but a spokesperson for the company declined to comment on the Origin incident when contacted by the ABC on Tuesday.

The criminal investigation into the data breach is ongoing. (AAP: Jay Kogler)

Putting 'legal defence' before customers

On Friday, Origin Energy confirmed to the ABC that the alleged hacker had not leaked or disclosed any customer data to the public.

Despite this, Origin has provided several support options for affected customers, including identity monitoring and 12 months of free credit monitoring.

The company has also recommended customers be cautious of any unusual or suspicious activity, particularly in communications that appear to come from Origin, the government, or their bank.

Cyber security expert Troy Hunt criticised the latest update from Origin on Friday, saying it and other large corporations are taking too long to inform and update customers potentially affected by a hack.

"[Origin is] saying a lot [in this latest announcement] without saying much," he told the ABC.

"Organisations are saying less and less, which is a shame.

"I would have liked to have understood a little more about the hack.

Troy Hunt says large corporations need to better communicate with affected customers. (ABC News: Jessica Lamb)

Mr Hunt believes large publicly-listed organisations too often prioritize information management over customer needs.

"Within these organisations there is a big component of trying to preserve shareholders' value," Mr Hunt said.

"Their primary accountability is not shareholders, not customers.

Executive bonuses slashed after breach

In its latest annual report published last Thursday, Origin Energy confirmed its executive managers would have their bonuses reduced as a result of the data breach.

It noted the board determined docking bonus pay would appropriately reflect "shared accountability and to recognise the large number of customers involved and the importance of the security of our systems and customer data".

That saw CEO Frank Calabria's pay reduced by $357,000, and other executive management reduced by $607,000.

But the board said it would consider future financial penalties against executives once all reviews and investigations had been completed.

It was the only financial mention of the data breach in its results, with the company noting it would be included in its results for the 2027 financial year instead.

Origin Energy recently announced that 900,000 current and former customers had their personal data leaked. But what have we learnt since?

The breach was first reported by The Australian in July, when the alleged hacker sent a sample of 50 customer records containing names, addresses, emails, dates of birth, phone numbers and billing histories.

Only after The Australian sent that information to Origin Energy did the company alert authorities to a potential security breach.

The data breach is believed to be the largest known incident experienced by an Australian energy retailer. A cyber incident in September 2022 resulted in details of hundreds of EnergyAustralia customers being exposed.

Origin Energy customers had reported delays in receiving their energy bills in the days before the data breach was confirmed. However, the company said it was not connected to the incident.

Origin is one of several major Australian companies to experience a security breach, after Qantas suffered a major hack in 2025 and Optus and Medibank experienced breaches in 2022.

On Wednesday, Quest Apartment Hotels became the latest business to experience a security breach that affected customers' data.

See more ABC coverage in your search results

Praticar Escuta