Origin Energy, one of Australia’s largest electricity and gas retailers, disclosed on July 28, 2026 that a data breach exposed records for 900,000 current and former customers. The compromised data includes names, dates of birth, phone numbers, addresses, account information, and partial payment card or bank account numbers. An individual claiming responsibility says they accessed data for 2 million customers and later claimed a ransom settlement had been reached — a claim Origin has not confirmed.
Origin Energy’s Disclosure of a 900,000-Customer Data Breach
Origin serves approximately 4.8 million customers across Australia, placing the 900,000 affected individuals at roughly one in five of the company’s total customer base. The breach encompasses both current and former customers, meaning the exposure is not limited to the active subscriber list.
Origin began investigating in early July 2026 after receiving a threat report it initially considered not credible. New evidence surfaced on July 22, prompting the company to escalate its investigation. The disclosure on July 28 followed that escalated review confirming the breach’s scope.
CEO Frank Calabrese stated that the matter is “subject to an ongoing investigation by the relevant authorities” and that disclosure constraints prevent Origin from providing additional details at this stage. The company has not identified which authorities are conducting the investigation or specified how the attacker accessed Origin’s systems.
What Data Was Stolen and the Disputed Scale of the Extortion Claim
Origin confirmed that the compromised data set includes names, dates of birth, phone numbers, addresses, account information, and partial payment card or bank account numbers. The company has not described the access method or the systems through which the attacker reached this data.
The individual claiming responsibility asserted they obtained records for 2 million customers — more than double the 900,000 Origin confirmed. This individual later stated that “an agreement had been reached with Origin and no data would be released.” Origin has not confirmed any settlement, ransom payment, or contact with the party making this claim. The discrepancy between the attacker’s claimed 2 million and Origin’s confirmed 900,000 may reflect the attacker overstating their access, or may indicate that Origin’s investigation has not yet established the full scope of the breach.
Origin warned customers explicitly that even if the individual claiming responsibility does not publish the data, other threat actors could obtain and use the stolen information to run scams and phishing campaigns targeting Origin customers. This warning acknowledges that once data leaves the organization, Origin has no control over how widely it spreads or who acts on it.
CEO Frank Calabrese’s Restricted Disclosure and Ongoing Investigation
CEO Frank Calabrese’s statement that disclosure constraints apply signals active coordination with law enforcement or a regulatory body whose investigation may be affected by public disclosure of operational details. Australian energy retailers operate under the Privacy Act 1988 and the Australian Energy Market Commission’s regulatory framework, creating obligations around data breach notification and customer communication.
Origin has notified affected customers and advised them on protective steps. The company has not announced credit monitoring or identity protection services for the 900,000 affected individuals. Origin’s customer warning about secondary phishing risk suggests the company anticipates that other threat actors will attempt to exploit the breach, even if the original party does not publish the data.
Customer Exposure After the Origin Energy Breach
The data confirmed as compromised supports several categories of follow-on fraud. The combination of home addresses, contact details, account information, and partial payment data creates conditions for utility fraud — where an attacker uses customer data to make fraudulent account changes, redirect billing, or impersonate customers in service interactions. The telephone numbers and addresses in the data set also support targeted scam calls and messages from threat actors impersonating Origin’s customer service team.
Origin’s explicit warning that other threat actors may act on the stolen data reflects the reality of breach markets: once a data set is accessed, it can be sold, traded, or published on criminal forums independent of anything the original attacker decides to do. The unconfirmed ransom settlement claim, if accurate, would not prevent data already copied from being used or distributed by parties not bound by any arrangement with Origin. Affected customers whose data is in the confirmed 900,000 should apply heightened skepticism to any unsolicited contact claiming to be from Origin, utility providers, or financial institutions in the period following this disclosure.
