Origin Energy Confirms Cyberattack Exposed Customers’ Personal and Financial Data

Origin Energy confirmed a cyberattack (22–24 July 2026) in which a threat actor using compromised employee credentials accessed and exfiltrated customer records, including names, addresses, dates of birth, contact numbers, account details and partial financial data (last four card digits and last three bank digits). The breach may affect up to two million accounts, has regulatory and critical-infrastructure implications, and prompted engagement from the Australian Cyber Security Centre, AFP and the Office of the Australian Information Commissioner; customers are urged to monitor accounts and be vigilant for phishing and fraud.