Origin Energy confirms customer data hack

Energy company Origin confirms there has been unauthorised access to and disclosure of some customers' data, a day after it announced it was investigating a "potential" breach. Origin Energy confirmed yesterday it was investigating a "potential" customer data breach. ( ABC News: Darryl Torpy ) Energy company Origin has confirmed there has been unauthorised access to and disclosure of some customers' data.

In a statement released via the ASX, the company said it was still working to understand the total number of affected customers and would contact any customers when it had confirmation. The company confirmed yesterday it was investigating a "potential" customer data breach. Origin said affected customer data may include name, address, date of birth, contact phone number and account information, and the last four digits of a credit card or last three digits of a bank account.

The company had previously told customers via email it did "not believe the impacted information includes customer credit card or bank details". Origin Energy has been emailing its customers about the potential data breach. "I'm sorry this has happened.

Customers trust Origin with their information, and I apologise for the impact this may cause, chief executive Frank Calabria said in a statement. "One of our key priorities is taking action to secure our systems and ensure no further unauthorised access. The incident was first reported at 12:21pm yesterday by The Australian, which had been contacted by an alleged hacker who sent the outlet a sample of 50 customer records containing names, addresses, emails, dates of birth, phone numbers and bill history.

It was only after The Australian sent that information to Origin that the company alerted authorities to a potential security breach. The company then notified the Australian Securities Exchange at 12:42pm. The statement this afternoon is the first comment made by the company regarding the incident since it confirmed its initial investigation.

The ABC has spoken to a person claiming to be behind the hack, and has been provided with what the person claims is a sample of data taken from a bigger customer list and internal screenshots of Origin computer systems. The ABC has not been able to confirm with Origin that this data is legitimate. Analysis of the sample shows it includes the real contact information that had not been publicly released in other major security breaches.

Origin is the country's largest energy retailer with more than 4.8 million customers across its electricity, gas, LPG and internet businesses. The data breach is believed to be the largest known incident experienced by an Australian energy retailer. A cyber incident in September 2022 resulted in details of hundreds of EnergyAustralia customers being exposed.

They included names, addresses, email addresses, electricity and gas bills, phone numbers, and the first six and last three credit card digits. Before the data breach was investigated and later confirmed, several Origin Energy customers had reported that there had been delays in receiving their energy bills. A customer told the ABC that he had assumed the company had been hacked after he did not receive his quarterly bill as usual on July 5. The man, who the ABC has chosen not to identify to protect his personal information, is a long-time Origin customer.