Origin Energy data breach: were my details in the 900,000 affected?

On 21 August 2026, Origin Energy said its review of a July incident was substantially complete. About 900,000 current and former customers had information accessed without authorisation. Origin has contacted them and is sending each person a notification that matches their own record.

For most people, that information was some mix of name, address, date of birth, phone number, account details, other personal circumstances they had shared with Origin, and the last four digits of a credit card or last three digits of a bank account. About 60 customers had a full bank-account number accessed; about 100 had an ID-document number (the number only, no scan); about 15,000 had a government concession or program number. Origin first raised a possible incident on 22 July, confirmed unauthorised access on 23 July, and published the 900,000 figure on 28 July. It has notified Australia's privacy and cyber authorities and the Federal Police. A criminal investigation is continuing.

Why “only 60 bank accounts” misses the point

Almost every report of this incident leads with 900,000 people and then immediately softens it: only about 60 had a full bank-account number taken. That figure is real. Origin published it. If you read it as permission to relax, you are reading the story the way the coverage is shaped, not the way a stranger with the file would use it.

What that stranger actually holds, for the great majority of those 900,000 people, is a working identity kit: a name, a home address, a date of birth, a phone number that reaches you, enough account detail to talk about an Origin bill, and the last few digits of a card or bank account. Those last digits are the same fragment companies often ask for to “confirm it is you”. Origin also said the records included other details about personal circumstances customers had chosen to share with their energy retailer.

This is not a dump of passwords or full credit-card numbers. It is the raw material of a convincing phone call. Someone who already knows where you live, when you were born, and part of how you pay can impersonate Origin, a bank, or a government office with far less guesswork. The 60 full bank-account numbers, the 100 ID numbers and the 15,000 concession numbers are the sharper end. They are not the only end that matters. Former customers are in this set too; leaving Origin does not take you out of it.

What to actually expect

• If you are a current or former Origin customer and you were among the 900,000, Origin says it has already been in touch and is issuing a notification specific to your record. That is the only reliable way to know. Nobody else can honestly tell you whether you were in this incident, and no online scan can either. A message that asks you to click or call back to “see if you were affected” is not Origin’s notification.
• In the coming weeks, expect calls, texts and emails that already know something true about you — your name, your suburb, part of an account or card number — and that urge you to verify, claim a refund, or lock something down. Some of that will be people riding the news; some of it may use this data. Either way, do not give more information or make a payment because the caller already had a few facts right.
• Origin is offering identity-monitoring and 12 months of credit-monitoring. The useful thing to watch there is a credit application or a new account you did not open. A sudden charge on a card you already have is less likely from this incident, because full card numbers were not what Origin described for the main group.
• If Origin’s notification says your full bank-account number, an ID-document number, or a concession number was involved, you are in the smaller group. Treat that number as known to someone who should not have it, and deal with that bank or agency first.

What you can and cannot fix

What left Origin cannot be pulled back. If your name, home address, date of birth, phone number, account details, or those last few card or bank digits were in the accessed records, they are out. So are any personal circumstances you had shared with the company. Origin cannot recall them. No removal service can either. A date of birth does not change. An address you still live at is still your address.

For about 60 people, a full bank-account number is out. For about 100, an ID-document number is out. For about 15,000, a government concession or program number is out. Those numbers cannot be un-known.

• Treat inbound contact about this claimed breach as untrusted. If you need to speak to Origin or your bank, start from an app, a bill, or a phone number you already had — not from a link or a number in a message that arrived this week.
• Use the monitoring Origin is providing. Twelve months of credit-monitoring is the practical check for someone trying to open credit in your name with a real date of birth and address. Enrol if you are offered it, and actually look at the alerts.
• If Origin told you a full bank-account number or ID number was involved, deal with that number. Ask the bank whether the account should be replaced. Be slower to accept that ID number, on its own, as proof of who you are.
• Shrink the rest of your public file. A leaked name, address and date of birth becomes much more dangerous when it is joined to people-search and data-broker listings that add relatives, extra phone numbers, employers and previous addresses. Those listings, unlike the Origin data, can actually be taken down. That is the lever that remains: make the leaked record harder to build on.