Origin Energy has confirmed a data breach affecting approximately 900,000 current and former customers. Names, addresses, dates of birth, phone numbers, and partial payment details — including the last four digits of credit cards or last three digits of bank accounts — were accessed by an unauthorised party. A hacker claiming responsibility says the real number is closer to 2 million and initially threatened to leak everything unless a ransom was paid.

The Timeline Is the Real Story

What stands out here isn’t the scale — it’s the delay. Origin had been reviewing a “potential security threat” since early July but initially assessed it as not credible. It took until 22 July for new information to force a reassessment, and 28 July for the full scope to emerge. That’s nearly a month from first signal to confirmed breach.

We see this pattern regularly across our Australian client base: a security alert arrives, it looks vague or low-confidence, and it sits in someone’s inbox. For SMBs without a dedicated security operations team — particularly in regional areas like the Central West or Northern Beaches where IT resources are stretched — those early indicators are even easier to miss because there’s no one whose sole job is to triage them daily.

What You Should Do Now

If you’re an Origin customer, reset your account password, enable two-factor authentication on any linked email accounts, and watch for phishing messages impersonating Origin over the coming weeks.

If you’re a business owner, this is a prompt to check how your organisation handles early threat signals. Do you have a defined process for triaging security alerts within 24 hours? If the answer is “sort of” or “our IT person checks when they can,” that’s a gap worth closing before it costs you.

All IT Services includes same-day threat triage as part of our managed IT support — when an alert fires, it gets assessed that day, not whenever someone next checks their inbox. For a broader look at how we protect Australian businesses, see our cybersecurity services.