At 12.42pm on Wednesday, Origin Energy (ASX: ORG) told the market it was looking into a data breach. The wording was careful. A “potential security incident” that “may involve unauthorised access to some customers’ data.” Two soft words sitting in that line. Potential. Some.
An unnamed hacker tells a different story. They claim to hold the personal details of about two million Origin customers. To prove it, they handed The Australian a sample of 50 records. Names. Addresses. Emails. Dates of birth. Phone numbers. And bill history.
That last one is the tell. Bill history is not something a scammer guesses. It confirms a live account. It says this person really is an Origin customer, and here is roughly what they owe.
One filing, two very different numbers
Origin says “some.” The hacker says two million. Both can’t be right, and the first filing is almost always the smaller number.
There’s a pattern to this. Firms hedge in the opening statement because they don’t yet know the full damage. Then the forensic team finishes, and the real figure drops. It usually drops worse. Medibank started cautious in 2022. The final count was 9.7 million people.
Origin runs roughly 4.8 million customer accounts across power, gas and internet. It held a 26.3% share of the residential electricity market as of March. A two-million-record haul, if it holds up, would touch close to half its base.
The company says forensic investigators are now sizing up the incident. It has told the Australian Cyber Security Centre and the Australian Federal Police. The Office of the Australian Information Commissioner has been pulled in too.
| Breach | Year | Records/people | Outcome so far |
| Optus | 2022 | ~9.8 million | OAIC + ACMA + ACCC actions; linked to 300,000+ fraud attempts |
| Medibank | 2022 | 9.7 million | OAIC case live; ~$125M+ cost plus $250M APRA penalty |
| Australian Clinical Labs | 2022 | 223,000 | $5.8M, first Privacy Act civil penalty |
| Qantas | 2025 | ~5.7 million | Data leaked to dark web; class action risk |
| Origin Energy | 2026 | “Some” / hacker claims 2 million | Under investigation |
Recent major Australian data breaches and where they landed. Origin’s figure is still unconfirmed. [Source: OAIC, Federal Court, and company disclosures]
What Origin didn’t lose matters less than what it did
The line the company leads with: no credit card or bank details. That sounds like relief. It isn’t much.
A stolen card gets cancelled in a phone call. A date of birth doesn’t. Neither does a home address, a mobile number, or an email tied to a real energy bill. Stack those together and a criminal has the starter kit for identity theft.
The bill history makes a fake message far more convincing. Take a text that reads “Origin: your account is overdue, tap to pay.” Now add the right suburb and a believable balance. That is how stolen data turns into cash.
So the comfort about cards misses the point. The dangerous stuff is the boring stuff.
The Origin Energy data breach lands in a much harsher legal climate
Timing is rough for Origin. The rules hardened after Optus and Medibank.
The maximum fine for a serious privacy breach is now the greater of $50 million, three times any benefit gained, or 30% of turnover across the breach period. That is not a parking ticket for a company that booked $17.22 billion in revenue last year.
The regulator has found its teeth as well. In 2025 the Federal Court handed down thefirst civil penalty under the Privacy Act. Australian Clinical Labs wore $5.8 million over a 2022 breach of 223,000 records. Cases against Optus and Medibank are still live. Medibank’s mess has already cost it more than $125 million, on top of a $250 million penalty from the prudential regulator.
Since June 2025 there’s a fresh tool for angry customers too. A statutory tort now lets individuals sue over a serious invasion of privacy. Two million upset account holders is a big pool of possible claimants.
Origin Energy (ASX: ORG) share price on 22 July 2026, drifting lower after the 12:42 pm breach filing.
Why the share price barely flinched
ORG slipped about 2.6% to $10.38 on the day. For a breach this size, that is a shrug.
The reason is simple. Electricity is sticky. A furious Qantas flyer can book Virgin next trip. An Origin customer can’t rage-quit the power point. Switching retailers takes effort, and most won’t bother over a breach. Low churn risk means the market isn’t pricing much lost revenue.
But that’s the wrong scoreboard. The bill from a breach doesn’t land on day one. It lands across quarters: legal costs, remediation, credit monitoring, regulator action, maybe a class action. Look at Qantas, whose stolen data surfaced on the dark web months after the hack. The share dip was the easy part.
One more oddity worth sitting with. No ransom demand has been made, as things stand. The hacker says they went to the press only after contacting Origin’s board, security team and customer care and getting nowhere.
That’s not a smash-and-grab for a payout. It reads like a pressure play, built to embarrass. Which means Origin lost control of the timing well before the filing hit the ASX.
For anyone tracking ORG, the takeaway is plain. The first number in a breach filing is a floor, not a ceiling. And “we don’t hold your card” was never the comfort it sounded like.
Origin says more updates will come “as appropriate.” The forensic report will carry the real story. History says it won’t read smaller than today’s.
Also Read: Mesoblast CEO Investment Lifts His Stake to 80.8m Shares
FAQs
Q: What did Origin Energy say was taken?
A: It hasn’t confirmed. Origin says card and bank details are not believed to be affected.
Q: How many customers are involved?
A: Origin says “some.” A hacker claims about two million.
Q: Did the share price move?
A: ORG fell around 2.6% to $10.38 on 22 July 2026.
Has a ransom been demanded?
A: Not as things stand, based on current reporting.
Q: What should Origin customers watch for?
A: Fake overdue-bill texts and emails that quote real account details.
Disclaimer: This article is general information only and does not consider any person’s objectives, financial situation or needs. It is not financial, investment or legal advice. Share prices and figures are indicative and subject to change. Anyone considering an investment decision should seek advice from a licensed professional and rely on primary sources such as official ASX announcements.
Source: https://cdn-api.markitdigital.com/apiman-gateway/ASX/asx-research/1.0/file/2924-03113242-2A1685461&v=undefined
Luke Carlino is a seasoned Copywriter, Content Strategist, and Social Media Manager specialising in Mining, Finance, and Business journalism. With more than a decade of industry experience, he brings rigorous editorial standards and commercial acuity to every project.
