Australian energy giant Origin Energy confirmed a cyberattack exposed personal data belonging to millions of its 4.8 million customer accounts. The company first flagged a potential security incident on July 22, then confirmed unauthorized access to customer data the following day.
Compromised information includes customer names, physical addresses, dates of birth, phone numbers, account details, and partial payment information — the last four digits of credit cards and the last three digits of bank accounts. Origin says these financial fragments are incomplete and cannot be used to hijack accounts or make unauthorized charges.
A threat actor going by the alias "John Doe" claims to hold data on 2 million customers and has threatened to leak it within two weeks unless Origin negotiates via Signal. CEO Frank Calabria apologized to customers and said the company is working to block further unauthorized access, while the Australian Federal Police, the Australian Cyber Security Centre, and the Office of the Australian Information Commissioner have all been notified. Security experts warn the exposed data could fuel convincing follow-up phishing scams.