Origin Energy confirms data breach; hacker claims 2 million customer records held for extortion
Australia's largest energy retailer says names, addresses, birth dates and partial bank details were exposed. An unidentified hacker calling themselves 'John Doe' has threatened to leak the data within two weeks.
Key points
- Origin Energy, Australia's largest energy retailer with 4.8 million customers, confirmed a data breach exposing personal information.
- A hacker using the name "John Doe" claims to hold records on 2 million Origin customers and is demanding negotiations via the Signal messaging app.
- Exposed data includes full names, home addresses, dates of birth, phone numbers, account details, the last four digits of credit cards and the last three digits of bank accounts.
- Origin has notified the Australian Federal Police, the Australian Cyber Security Centre and the Office of the Australian Information Commissioner.
- The hacker has set up a leak site and threatens to publish the stolen data in two weeks unless Origin responds.
Origin Energy, the Australian company supplying electricity, natural gas and broadband to millions of homes, has confirmed criminals broke into its systems and stole customer data.
Origin has 4.8 million customers. It's still working out how many were caught up in the breach and says it will write to each affected person directly.
Listed on the Australian stock exchange, the company brings in about $8.5 billion a year and holds a 20% stake in UK renewable retailer Octopus. It's one of the country's biggest utilities, and this is one of Australia's biggest names to be hit this year.
What was stolen?
Origin says exposed data includes full name, home address, date of birth, phone number, account information, the last four digits of a credit card and the last three digits of a bank account.
Those partial card and bank numbers can't, on their own, be used to move money or hijack accounts, the company said. But the full package of name, address and phone number is exactly what fraudsters use to impersonate people, open accounts in their name, or craft convincing scam calls.
| Detail | Figure |
|---|---|
| Total Origin customers | 4.8 million |
| Records the hacker claims to hold | 2 million |
| Ransom deadline claimed | Two weeks |
| Contact channel demanded | Signal messenger |
Who is behind it?
Someone using the name "John Doe" contacted Australian broadcaster 7news claiming responsibility before Origin publicly confirmed the breach. The person hasn't been linked to any known ransomware crew.
They told 7news they'd tried to reach Origin's security team, customer support and senior executives without a reply. A leak site is now live, with a two-week deadline: negotiate on Signal or the data goes public.
This pattern, direct extortion without deploying file-locking malware, has grown more common through 2024. Groups like Cl0p have built entire operations around pure data theft. It's faster, cheaper and skips the technical difficulty of encrypting a live energy retailer's systems.
Origin hasn't said whether it plans to negotiate. Australian government guidance strongly discourages paying, and there's no evidence a payment has been made or offered.
Should Origin customers be worried?
Yes, though the risk is fraud and scams rather than direct theft from your bank account.
Expect a rise in phishing attempts: fake emails or texts pretending to be from Origin or your bank, now carrying enough real detail about you to sound credible. Don't click links in unexpected messages, even ones quoting your correct address or account number. Call your provider on a number you find yourself. If you're concerned about identity fraud, consider a credit freeze through Australia's main credit bureaus. Origin says it's offering a dedicated support portal to confirmed victims.
For a broader guide on what to do after a breach, our explainer from 23 July covers the steps in plain terms.
What happens next?
Origin has told the Australian Federal Police, the Australian Cyber Security Centre and the Office of the Australian Information Commissioner. CEO Frank Calabria apologised to customers and said the company is working to block further access.
The breach, first reported by BleepingComputer, arrives as Australia is still absorbing the Optus and Medibank incidents. Regulators are watching, and fines under the country's updated privacy laws can run into the tens of millions. The two-week clock is ticking, and if Origin doesn't engage publicly, the next story is whether that data appears on the leak site.
