Personal and banking details among customer data stolen in Origin Energy hack

Origin Energy customers’ addresses, phone numbers and partial bank account data have been accessed in a hack, the company has confirmed.

The company has 4.8m customer accounts in Australia, providing electricity, natural gas, LPG, and internet services to homes and businesses.

Origin has yet to confirm which and how many customers had been affected. In a statement to the ASX on Thursday, it said it would tell customers once it confirmed they had been impacted.

Origin said impacted data may include customers’ names, addresses, dates of birth, contact phone numbers and Origin account information, as well as the last four digits of a credit card, or the last three digits of a bank account.

The company said incomplete credit card or bank account information could not be used to make purchases or access accounts.

Origin had first revealed the hack in a statement yesterday, where it said it believed credit card or bank details had not been accessed. The company has not detailed how the hack occurred.

Origin’s chief executive, Frank Calabria, said the company was securing its systems and ensuring there was no further unauthorised access, working with independent cyber experts and authorities.

“I’m sorry this has happened,” Calabria said.

“Customers trust Origin with their information, and I apologise for the impact this may cause.”

Origin said the Australian Cyber Security Centre, the Australian Federal Police and the Office of the Australian Information Commissioner (OIAC) were all investigating.

The Australian reported it was contacted by a person claiming to have hacked Origin on Tuesday, after which the newspaper alerted Origin, which made a statement on Wednesday.

An Origin spokesperson said the company had moved immediately to update the ASX as soon as it was aware of a potential incident.

The OIAC reported it received 1,205 data breach notifications in 2025, of which 716 were related to malicious or criminal activity.

Among the hacks was a leak of 5m Qantas customers’ information in October, which prompted warnings scammers could cold call leaked phone numbers.

The federal privacy commissioner last week found Qantas did not make any omissions or failings in breach of the Privacy Act, in relation to the hack.