Origin Energy chairman Scott Perkins told shareholders at the October 14 AGM that there is no evidence stolen customer data has been published on the internet or dark web. The July 2026 breach affected approximately 900,000 customers and former customers, exposing names, addresses, and dates of birth. Additionally, full bank account numbers were accessed for around 60 customers, and identity document numbers for approximately 100 customers. Origin has upgraded its cybersecurity systems. The risk of future publication remains, and Origin’s CEO notably made no mention of the incident in his own shareholder address.
What the Breach Exposed and Who Is Most Affected
The broad data category names, addresses, and dates of birth for 900,000 people describes what the majority of affected customers need to think about. That combination is standard personal identifying information, useful for phishing, social engineering, and identity fraud.
But two smaller subsets represent a materially higher risk level.
Approximately 60 customers had their full bank account numbers accessed. That’s a fundamentally different type of exposure. A name and address tells a scammer who you are. A full bank account number gives them something to act on directly , potentially enabling unauthorised transactions, debit reversals, or being used in combination with identity information to impersonate you to a financial institution.
Approximately 100 customers had identity document numbers exposed likely passport or driver’s licence numbers. Identity document numbers are particularly difficult to change, and they’re used across multiple government services, lending applications, and employment verification processes.
For those two specific groups, the exposure is qualitatively more serious than for the broader 900,000. If you received a notification from Origin in late July 2026, and you’re in Australia, it’s worth revisiting what that notification said specifically whether you were in the general data category or whether your bank or identity document information was noted as accessed.
This is similar to the pattern we’ve seen in how breach subsets create disproportionate harm , 60 people with bank account numbers exposed face a categorically different risk than 900,000 people whose addresses are known.
The 20-Day Notification Gap That’s Drawn Criticism
Origin has faced pointed criticism not just for the breach itself but for how long it took to tell customers about it.
The company first became aware of a possible breach on July 2. Customer notifications didn’t begin until July 22, twenty days later. CEO Frank Calabria has defended the timeline, saying “the information did not become credible until the later date.” That framing credibility requiring additional time to establish, is the standard explanation large organisations offer for notification delays. Whether you find it persuasive depends on how you weigh the organisation’s need to investigate against the customer’s need to know.
Australia’s Notifiable Data Breaches scheme under the Privacy Act generally requires notification as soon as practicable, with no fixed window but an expectation of speed. A 20-day gap, while arguably within the scheme’s expectations, is not what affected customers would have wanted.
This matters now because Origin’s AGM statement says the dark web risk remains. If new information emerges say, if the data does eventually appear in a criminal forum, customers who were notified in July have had months to take protective steps. But the notification gap means those protective steps also started 20 days later than they could have.
Who Was Behind It: The Accenture Connection
One of the most significant unreported angles in the general coverage of the Origin breach is where the intrusion appears to have originated. The Australian Financial Review reported in August that the investigation was pointing toward an offshore employee of Accenture, Origin’s IT services partner.
If accurate, this is not a case of external hackers breaking through Origin’s perimeter. It’s a third-party insider access incident , an employee at a contracted vendor using legitimate system access in ways it wasn’t intended to be used.
This distinction has practical implications. Traditional cybersecurity controls firewalls, endpoint protection, network monitoring are designed to detect external attackers. They’re less equipped to flag an employee of an authorised partner accessing data they’re technically permitted to access, in larger volumes or different patterns than normal. It’s the same structural challenge we’ve covered in looking at how supply chain third-party access creates invisible exposure paths, the most trusted access is often the hardest to monitor effectively.
Origin has not publicly confirmed the Accenture attribution. Accenture has not commented publicly.
Why CEO Frank Calabria Didn’t Mention the Breach
Perkins’s AGM statement updated shareholders. But in the same meeting, CEO Frank Calabria’s own address to shareholders made no mention of the breach at all.
That silence is notable. Chief executives typically address significant incidents affecting hundreds of thousands of customers at annual meetings, particularly when the incident has been subject to public scrutiny and media coverage. Calabria’s decision to leave the cyber update entirely to the chairman suggests either a deliberate separation of responsibilities or an active choice not to address the event directly.
Whether that choice reflects a legal strategy around the ongoing investigation, a decision that the chairman’s statement was sufficient, or something else, hasn’t been explained. What it means in practice is that the person who managed the incident , Calabria was the CEO during the breach, the notification delay, and the subsequent bank account discovery , wasn’t the person who reported on it to shareholders.
The “No Evidence” Statement and What It Doesn’t Tell Us
Perkins’s “no evidence of publication” statement carries real weight, and it’s genuinely good news within its own scope. Dark web monitoring is systematic; if Origin’s data were being actively traded on known criminal forums, it would typically be detectable.
But there are limits to what that statement covers. It means the data hasn’t appeared on monitored dark web forums and marketplaces. It doesn’t mean the data hasn’t been used in private criminal transactions. It doesn’t mean the attackers haven’t accessed it multiple times internally. And it doesn’t mean the data won’t appear in future.
As the recent Australian Medicare dark web claim showed, data from Australian organisations can surface in criminal markets months after the initial theft sometimes recycled, sometimes genuine, always problematic. Perkins is right that the absence of current dark web publication doesn’t eliminate the ongoing risk. Data stolen in July 2026 could surface in January 2027 without violating anything Perkins said at today’s AGM.
What Origin Customers Should Do Right Now
If you are or were an Origin Energy customer and received a notification in July 2026, the practical response hasn’t changed since then, but the AGM statement is a good prompt to revisit what you’ve done.
Monitor your bank account for unexpected debits or authorisations. If you’re in the smaller group whose bank account number was accessed, consider calling your bank to ask about additional protections or to verify that no unauthorised access has occurred.
Watch for phishing calls, texts, or emails that reference your Origin account, your energy usage, or your address in ways that feel too specific. Breached personal data is commonly used to make social engineering attempts more convincing.
Check your credit report for unexpected credit applications. Names, addresses, and dates of birth are the standard combination used to apply for finance in someone else’s name.
Report any suspected misuse to the Office of the Australian Information Commissioner and to Scamwatch.
For the full checklist on what to do when your personal data has been exposed, our dark web data exposure guide covers the steps in the order they matter.
Frequently Asked Questions
Has Origin Energy data been published on the dark web?
As of October 14, Origin’s chairman Scott Perkins told shareholders there is no evidence of that. The risk of future publication remains.
How many people were affected by the Origin breach?
Approximately 900,000 current and former customers had names, addresses, and dates of birth exposed. About 60 customers had full bank account numbers accessed, and around 100 had identity document numbers accessed.
When did Origin notify customers?
Origin became aware of a possible breach on July 2, 2026, and notified affected customers starting July 22 , a 20-day gap that has drawn public criticism.
Who was responsible for the breach?
The Australian Financial Review reported in August that the investigation was pointing to an offshore employee of Accenture, Origin’s IT services partner. This has not been publicly confirmed by Origin or Accenture.
What should Origin customers do?
Monitor bank accounts, watch for targeted phishing using your personal details, check your credit report, and report concerns to the OAIC and Scamwatch.
