Origin Energy says data breach affected about 900,000 customers

Origin Energy says a cyber incident exposed personal information belonging to about 900,000 current and former customers, creating an increased risk of scams and identity-based fraud.

The Australian energy retailer disclosed on Tuesday, July 28, 2026, that the affected data may include names, addresses, dates of birth, phone numbers and account information. Some records may also contain the last four digits of a credit card or the last three digits of a bank account.

Chief executive Frank Calabria apologized and urged customers to watch for suspicious activity. Origin said a significant share of those affected were former customers and that notifications would be sent in the coming days.

Calabria said the company first received emails from someone claiming to have customer records on July 2, but did not then regard the threat as credible because no proof of access was supplied. Origin said it received evidence on July 22 and publicly announced the incident that day.

The company said historical data appeared to have been accessed without authorization and that it had acted to secure its systems. Origin does not currently believe the information has been posted on the dark web. The matter remains under criminal investigation, and the company has declined to address questions about the breach method, any insider involvement or whether a ransom was demanded.