Origin Energy Hack: Customer Data Stolen – What You Need to Know 2026

In a recent cybersecurity incident, the Origin Energy hack has compromised personal and banking details of millions of Australian customers, raising serious concerns about data security and identity theft. Origin Energy, one of Australia's largest energy retailers with 4.8 million customer accounts, confirmed that hackers accessed names, addresses, phone numbers, dates of birth, Origin account information, and partial credit card or bank account numbers. The company stressed that incomplete financial data cannot be used for purchases or account access, but experts warn that the stolen information can be exploited for targeted phishing scams and even physical crimes like burglary.

What Data Was Stolen in the Origin Energy Hack?

The breach exposed a wide range of personally identifiable information. According to Origin's statement to the ASX, the compromised data includes:

• Full names and addresses
• Dates of birth
• Phone numbers
• Origin account details
• Last four digits of credit cards or last three digits of bank accounts

While Origin initially believed no credit card or bank details were accessed, they later confirmed that partial financial data was indeed exposed. A hacker claiming responsibility has reportedly contacted media outlets with unverified claims that 2 million customers' details were accessed, though Origin has not yet confirmed the exact number affected.

How the Breach Happened

Origin has not disclosed the specific method used by the attackers. However, cybersecurity experts note that energy companies are prime targets because they hold vast amounts of personal and financial data. The company is now working with independent cyber experts and authorities to secure its systems and prevent further unauthorized access. CEO Frank Calabria apologized to customers, stating, “I’m sorry this has happened. Customers trust Origin with their information, and I apologise for the impact this may cause.”

Risk Assessment of Exposed Data

Although the partial financial data is not enough to make purchases, when combined with other details like name and address, it can be used in social engineering attacks to trick customers into revealing full account numbers or passwords.

What to Do If You Are an Origin Energy Customer

If you have an Origin Energy account, take these steps immediately to protect yourself:

• Enable two-factor authentication on your online account
• Monitor bank and credit card statements for suspicious activity
• Place a fraud alert with credit reporting bureaus
• Be wary of unsolicited calls, emails, or texts claiming to be from Origin – verify by calling the official customer service number
• Consider freezing your credit files to prevent new account openings

Rumpa Dasgupta, a cybersecurity lecturer at La Trobe University, warns that personalized records can be misused for physical robberies by scammers who know your address and schedule. Staying vigilant is crucial.

FAQ

The Origin Energy hack is a stark reminder that even large, well-established companies can fall victim to cyberattacks. Stay informed, update your passwords, and report any suspicious activity to both Origin Energy and local authorities. For ongoing updates, follow news from the Australian Cyber Security Centre.