Origin Energy, Australia’s largest energy retailer, confirmed on 23 July that an unauthorised party accessed customer data including names, addresses, dates of birth, phone numbers, and partial payment details. A threat actor claiming responsibility says they hold records for two million of Origin’s 4.8 million customers and has threatened to leak the data within two weeks.

Who’s affected

If your business or staff have Origin Energy accounts — electricity, gas, or broadband — assume the associated personal details are compromised until you hear otherwise. Origin is contacting confirmed impacted customers directly.

What to do today

Check whether anyone in your team uses their Origin account email and password combination on business systems. Credential reuse is the single fastest way a consumer breach becomes a corporate one — and it’s something we see constantly across Australian SMB environments. If the same password appears anywhere in your business stack, change it now and enable MFA.

Beyond credentials, be alert for phishing emails impersonating Origin over the coming weeks. Attackers routinely weaponise breach data to craft convincing follow-ups — fake invoices, “verify your account” messages, or bogus refund offers. With tax-time phishing already at peak levels, this adds another vector your team needs to watch for.

If your business doesn’t have a clear process for responding when a supplier or utility provider is breached, that’s a gap worth closing. All IT’s cybersecurity team can help you build a vendor breach response checklist that’s practical to maintain.

Origin has notified the Australian Federal Police, the ACSC, and the OAIC. Monitor their incident page for updates.