Australia’s largest energy retailer has experienced a major cybersecurity incident today.

In a statement issued via Origin’s website and the Australian Stock Exchange (at 12:42 pm), the company revealed that it is investigating a possible security incident that could involve unauthorized access to some customers’ data.

Origin Energy serves approximately 4.7 million customer accounts nationwide, providing electricity, natural gas, LPG and broadband Internet. Given that huge footprint, even a minor breach has the potential to become a huge national headache.

Poor communications with the client

Naturally, the news has spread through social media channels today, but by way of official notification, there have been no emails or SMS messages to customers, and it is only many hours later that we see a small notification at the top of their website and mobile app.

In 2026, many customers turn to social media for more information, and instead of posting about the security incident, Origin appears to hide its answers in the comments, only when users explicitly ask.

This occurred on both X and Facebook and at the time of writing, there was nothing on the Instagram, LinkedIn, TikTok or YouTube channels for Origin.

Frankly, in 2026 this is not good enough, not even close.

What the hell?

The details of the cyber incident are still being confirmed, less than 12 hours have passed and there is a long way to go.

ABC says they spoke to someone who claims to be behind the hack, providing sample data taken from Origin, including internal screenshots of Origin’s computer systems.

So far, they haven’t been verified, but it seems pretty simple to do: hand them over to Origin Energy and let them validate.

The content suggests that this is a new breach, not simply accumulated data from other security breaches, so the question is: how much data did they get and how?

Origin says they do not believe hackers obtained credit card numbers or banking details. While this may be reassuring from a financial perspective, Origin will still have a lot of personally identifiable data about account holders. More on ABC: https://www.abc.net.au/news/2026-07-22/origin-energy-investigating-potential-data-breach/106944660

The huge sanctions that weigh on Australian companies

In the wake of these major scandals, the Australian government realized that imposing a small fine on companies was useless. Parliament quickly passed sweeping reforms to the Privacy Act to impose eye-watering financial consequences.

Previously, the maximum penalty for a serious or repeated breach of privacy was capped at a modest A$2.22 million. For a billion-dollar corporation, that amounted to little more than a rounding error on an annual balance sheet.

Under current laws, regulators can impose fines of up to A$50 million on organizations that do not comply. Alternatively, penalties can reach 30 percent of the company’s adjusted turnover during the period of non-compliance, or three times the value of any profit made.

These staggering multimillion-dollar fines were specifically designed to force boards of directors and executives to prioritize cybersecurity. If Origin Energy is found to have neglected reasonable security measures, the financial consequences could be serious.

What Origin Energy customers should do right now

While we wait for Origin Energy to complete its forensic investigation, customers need not sit helplessly. Taking proactive steps right now is the smartest way to protect your personal identity.

First, be on high alert for unexpected emails, text messages or phone calls claiming to be from Origin Energy. Scammers love to take advantage of breaking news by sending fake messages asking you to verify your account details or pay overdue bills.

Second, if you use your Origin Energy account password on any other online service, change it immediately. Reusing passwords across multiple websites is the easiest way for attackers to compromise your other accounts through credential stuffing.

Third, make sure two-factor authentication is enabled on all your primary email and bank accounts. Adding an extra layer of verification makes it much harder for identity thieves to breach your digital life.

Finally, consider temporarily freezing credit through Australia’s major credit reporting agencies such as Equifax, Experian and Illion. A credit freeze prevents anyone from applying for loans or credit cards in your name without your explicit permission.

The bottom line for Australian energy consumers

The potential security incident at Origin Energy is another stark reminder that corporate data breaches are a constant reality of modern life. Until companies treat customer data protection as core infrastructure and not an afterthought, consumers will bear the burden.

Origin Energy has promised to share further updates on its dedicated support page as the investigation develops. We will closely monitor how the company handles communications and whether the hacker’s claims remain under scrutiny.

If you’re an Origin Energy customer, keep your guard up, check every suspicious communication, and stay tuned for official updates from the retailer.

For more information, head to Origin Energy

.