Origin Energy Confirms Data Breach Exposing Customer Information
Summary
Origin Energy confirmed unauthorized access to customer data, including personal information and partial financial details. It is investigating the impact; a threat actor called “John Doe” separately claims data from 2 million customers and threatens to leak it.
Key points
- Origin Energy confirmed a breach involving unauthorized access to customer data and is investigating how many customers were affected.
- Potentially exposed information includes names, addresses, dates of birth, phone numbers, account information, and the last four digits of credit cards and last three digits of bank accounts.
- Origin said the partial financial details are incomplete and cannot be used to hijack accounts or make unauthorized bank charges.
- The company is notifying confirmed impacted customers, offering support through a dedicated portal, and taking steps to block further unauthorized access.
- Origin informed the Australian Federal Police, the Australian Cyber Security Centre, and the Office of the Australian Information Commissioner.
- A threat actor identifying as “John Doe” claimed to hold data on 2 million customers and threatened to leak it unless Origin contacted them to negotiate; this claim is not independently confirmed in the article.
Article Details
- Victim Organization
- Origin Energy
- Incident Type
- Data breach involving unauthorized access to customer data
- Data Types Exposed
- Full names
- Physical addresses
- Dates of birth
- Phone numbers
- Account information
- Last four digits of credit cards
- Last three digits of bank accounts
- Affected Records
- Origin is investigating how many customers were affected. John Doe alleged possession of data for 2 million Origin customers.
- Operational Impact
- Origin is investigating the breach, notifying confirmed impacted customers, providing support, and taking steps to block further unauthorized access. No service disruption is reported.
- Ransom Or Extortion
- John Doe threatened to leak the allegedly stolen data in two weeks unless Origin contacted them via Signal to negotiate. No ransom amount was reported.
- Claim Status
- confirmed