Origin Energy, Australia's largest energy retailer, said a data security incident led to the acquisition of personal data from around 900,000 current and former customers. Origin, which has around 4.8 million customers by the end of 2025, said on Tuesday that the company is working with cybersecurity and forensic experts to control the incident. The company first announced the incident last week. Origin, which is listed on the Australian Stock Exchange, said last week that the leak revealed the customer's name, date of birth, contact information, and some credit card information. Origin said on Tuesday that it had completed the initial stages of investigating the incident, but did not provide details on the findings other than disclosing the number of affected customers. The company said it is cooperating with the Australian federal government and security agencies. Origin said it has notified the Australian Information Commissioner's Office of the matter. The supervisory authority may refer the case to the criminal department or bring legal action if it believes that the parties involved have breached privacy protection obligations.

Origin Energy, Australia's largest energy retailer, said a data security incident led to the acquisition of personal data from around 900,000 current and former customers. Origin, which has around 4.8 million customers by the end of 2025, said on Tuesday that the company is working with cybersecurity and forensic experts to control the incident. The company first announced the incident last week. Origin, which is listed on the Australian Stock Exchange, said last week that the leak revealed the customer's name, date of birth, contact information, and some credit card information. Origin said on Tuesday that it had completed the initial stages of investigating the incident, but did not provide details on the findings other than disclosing the number of affected customers. The company said it is cooperating with the Australian federal government and security agencies. Origin said it has notified the Australian Information Commissioner's Office of the matter. The supervisory authority may refer the case to the criminal department or bring legal action if it believes that the parties involved have breached privacy protection obligations.