Origin Energy confirmed on Thursday that customer data had been accessed and disclosed without authorisation, and by Friday had not said how many of its 4.8 million customers were affected.
The company, Australia's largest electricity and gas retailer, told the market on Wednesday it was investigating a potential security incident, then confirmed the breach the following day. The data that may have been taken includes names, residential addresses, dates of birth, phone numbers and account details, along with the last four digits of credit card numbers and the last three digits of bank account numbers. Origin said those financial details are incomplete and cannot be used to make transactions.
Chief executive Frank Calabria apologised. "I'm sorry this has happened. Customers trust Origin with their information, and I apologise for the impact this may cause," he said.
Origin said it was working with the Australian Cyber Security Centre, the Australian Federal Police and the Office of the Australian Information Commissioner, had engaged independent cyber experts, and had set up a support line. Individual notifications will go out as the company works out who was affected.
The scams arrived first. Within a day, messages posing as Origin were circulating by email and text, asking for passwords and banking details. Websites have been registered on domains close to the company's own. There have been calls from people claiming to be Origin procurement staff, and fake job offers using the company's name.
Rumpa Dasgupta of La Trobe University said energy account data reveals household patterns, and can support targeted phishing as well as physical crimes such as burglary, because consumption records show when a property is empty. Jacqueline Boaks of Curtin University's Centre of Applied Ethics said companies have to do better on how quickly they notify and on the language they use to describe what happened. Rahat Masood of the University of New South Wales said Origin had moved quickly, and that customers expect strong protections from an essential service provider.
An energy account is not optional. Connecting a household to electricity or gas means handing over identity documents, and switching retailer does not retrieve what the previous one already holds. The Privacy Act allows the information commissioner to pursue civil penalties for serious or repeated interference with privacy, but that turns on findings nobody has made yet, and the OAIC has not announced an investigation.
Until Origin publishes a number, the practical advice is unchanged and it comes from the company itself: treat unexpected contact claiming to be from Origin as suspect, check sender addresses, pay bills only through Origin's own app or website, and report scam messages to Scamwatch.
