Australian energy giant Origin Energy discloses customer data breach (2026)

On 22 July 2026, Origin Energy — one of Australia's largest electricity and gas retailers — disclosed to the Australian Securities Exchange (ASX) that it was investigating a potential security incident that might involve unauthorised access to some customers' data. The next afternoon, in a further filing, the company confirmed that unauthorised access to and disclosure of customer data had in fact occurred.

What was exposed

Origin said the affected information included customers' names, addresses, dates of birth, phone numbers, and account details, along with limited payment information such as the last four digits of a card or the BSB and last three digits of a bank account. The company stressed that full credit-card and bank-account details did not appear to be among the exposed data. In a public statement issued the following week, Origin put the number of current and former customers affected at approximately 900,000, a figure that grew as the company worked through its records.

Response and investigation

Origin activated its incident-response plans, engaged external cybersecurity specialists, and began notifying affected customers. The breach was referred to and examined by Australian authorities, including the Australian Cyber Security Centre, the National Office of Cyber Security, the Australian Federal Police, and the Office of the Australian Information Commissioner, which oversees privacy obligations under Australian law.

Why it matters

As an energy retailer serving millions of households, Origin sits within Australia's critical-infrastructure perimeter, and a breach of its customer base feeds directly into the identity-fraud economy that has followed successive large Australian data breaches. The incident also illustrates the disclosure discipline expected of ASX-listed companies: Origin moved from an initial "investigating" notice to a confirmation of unauthorised access within roughly a day, keeping the market informed as its understanding of the event evolved.