Breaking: Origin Energy believes 900,000 customers' data accessed in breach

Origin Energy Confirms Data Breach Affecting Up to 900,000 Customers

Origin Energy, Australia's largest energy retailer, has confirmed a data breach that may have affected approximately 900,000 current and former customers, as reported by ABC Australia and The Guardian. The company, which has 4.8 million customer accounts, said it is investigating the incident and working to determine the full extent of the impact.

In a statement released via the Australian Securities Exchange, Origin said there had been unauthorised access to and disclosure of some customers' data. The affected data may include names, addresses, dates of birth, contact phone numbers and account information, as well as the last four digits of a credit card or the last three digits of a bank account, according to reports from ABC Australia and The Guardian.

The company initially said it did not believe the impacted data included full customer credit card or bank details. Origin has stated that incomplete credit card or bank account information could not be used to make purchases or access accounts, as reported by The Guardian.

Company's Response and Timeline

Origin first alerted the market to a "potential" security breach in a statement yesterday, as reported by ABC Australia. The company said it had been reviewing a potential security threat since early July, but that based on the information available at the time, it was not assessed as credible, according to ABC Australia.

On 22 July, Origin said new information emerged indicating a potential security incident, and the company acted immediately, providing updates to the market and notifying customers, as reported by ABC Australia.

According to The Guardian, Origin's chief executive, Frank Calabria, said the company received emails from someone claiming to have accessed customer records on 2 July, but did not determine it was a credible threat as there was no proof of data being accessed. The Guardian reported that Origin received proof that customer data had been accessed on 22 July, at which point it announced the hack.

Calabria apologised for the incident, saying, "I'm sorry this has happened. Customers trust Origin with their information, and I apologise for the impact this may cause," as quoted in ABC Australia and The Guardian. He also warned customers to watch out for suspicious activity and a heightened risk of scams.

The company said it had notified the Australian Cyber Security Centre, the Australian Federal Police and the Office of the Australian Information Commissioner, as reported by ABC Australia and The Guardian.

Coverage Comparison

The coverage from ABC Australia and The Guardian differs in emphasis. ABC Australia's initial reports focused on the company's confirmation of the breach and its investigation, while later reports highlighted the potential impact on 900,000 customers and the timeline of the company's response. The Guardian's coverage took a more critical tone, particularly in its report that Origin was warned of the hack three weeks before it made the data breach public, and in its use of the word "admitted" in that context.

In contrast, ABC Australia's reporting of the same timeline noted that Origin had been reviewing a "potential security threat" since early July and that it had not been assessed as credible at that time, without framing this as a delay.

Both outlets reported the same core facts: the breach affected approximately 900,000 customers, the data accessed included names, addresses, dates of birth, phone numbers and account information, and the company said it did not believe full credit card or bank details were compromised.

Key Claims

• The breach affected approximately 900,000 current and former customers, as reported by both ABC Australia and The Guardian.
• Affected customer data may include name, address, date of birth, contact phone number and account information, as well as the last four digits of a credit card or last three digits of a bank account, as reported by both outlets.
• The company does not believe the impacted data includes customer credit card or bank details, as reported by ABC Australia and The Guardian.
• The company has 4.8 million customer accounts in Australia, as reported by both outlets.
• The Guardian reported that Origin was warned of the hack three weeks before it made the data breach public, a claim not present in the ABC Australia coverage.
• Cyber security experts quoted by ABC Australia warned that the stolen personal details could give scammers the opportunity to launch highly targeted attacks, including convincing phishing emails, phone calls and text messages.

Expert Warnings on Scam Risks

The ABC Australia reported that cyber security experts have warned that personal details stolen in the breach could be used by scammers to launch highly targeted attacks, especially with the aid of artificial intelligence to impersonate victims, clone voices and build detailed personal profiles. Professor Richard Buckler, a cyber security expert at the University of New South Wales, told ABC Australia that the greatest risk for most customers is not the breach itself, but opportunistic scammers exploiting anxiety surrounding the breach. He advised customers to "be alert but not alarmed" and avoid clicking links in unsolicited emails or text messages.