Origin Energy confirms hack<\/a><\/p>\n Energy company Origin has confirmed that there has been unauthorised access and disclosure of some customers’ data, a day after it announced it was investigating a “potential” breach.<\/p>\n The information included names, dates of birth, phone numbers, home addresses and email addresses, as well as the last four digits of some credit cards and the last three digits of some bank account numbers.<\/p>\n Origin is Australia’s largest energy retailer with more than 4.8 million customers. The company said it was still working to determine the total number of people affected and would notify impacted customers once their details had been confirmed.<\/p>\n While there is no indication full payment card details were compromised, experts say the stolen information remains highly valuable and are urging affected customers to remain cautious about unsolicited emails, text messages and phone calls long after the breach.<\/p>\n Scams pretending to help you<\/p>\n Professor Richard Buckler, a cyber security expert at the University of New South Wales (UNSW), said the greatest risk for most customers was not the breach itself, but opportunistic scammers exploiting anxiety surrounding the breach.<\/p>\n “The secondary attacks tend to catch more people than the original attack and cause more damage,” he said.<\/p>\n “They can appear to be trying to help you … ‘Your data’s been stolen, just verify yourself to us, and we’ll fix it for you’ or ask you to log into a website.”<\/p>\n His advice was for customers to “be alert but not alarmed” and avoid clicking links in unsolicited emails or text messages.<\/p>\n This fake Netflix email is an example of a phishing scam. Experts warn criminals could use stolen Origin customer data to create even more convincing messages. (Supplied: consumer.ftc.gov)<\/p>\n Rahat Masood, a senior lecturer in cyber security at UNSW’s School of Computer Science and Engineering, said criminals no longer needed bank details to launch convincing attacks.<\/p>\n “People think data is only sensitive if it includes credit card details or bank details,” she said. “But that’s not the case anymore.”<\/p>\n The anatomy of a phishing scam<\/a><\/p>\n Phishing is\u00a0the most commonly reported scam in Australia, with scammers harvesting tens of millions of dollars every year from unsuspecting victims.<\/p>\n Dr Masood said names, phone numbers, email addresses and home addresses could be combined with information from social media and other public sources to create highly personalised phishing emails, text messages and phone calls.<\/p>\n “They can actually build a whole lot of scenarios where they … pretend to be a friend, family member or bank representative, asking you to share sensitive information, make a transaction or transfer money.”\u00a0<\/p>\n She said AI had dramatically accelerated that process, allowing criminals to rapidly search public information, build detailed profiles of victims and generate personalised scam messages “in seconds”.<\/p>\n “If they know your profile, they can send you a very promising job link or pretend to be someone you trust,” Dr Masood said.<\/p>\n “And you never know what’s behind that link. It could be malware and lead to further breaches.”<\/p>\n Identity theft in the AI era\u00a0<\/p>\n Professor Daswin De Silva, director of the Centre for Data Analytics and Cognition at La Trobe University, said if the combination of personal information was exposed, then the breach could also allow criminals to impersonate customers and bypass some identity checks.<\/p>\n “The last four digits of a credit card are often used to verify someone’s identity,” he said.<\/p>\n “Cyber criminals can now use this information to launch impersonation attacks by pretending to be Origin customers.”<\/p>\n Professor De Silva said many online retailers already stored customers’ payment details, meaning criminals might only need enough information to satisfy identity checks before attempting purchases.<\/p>\n “You don’t always need the full card number,” he said.\u00a0<\/p>\n “Some organisations authenticate customers using the last four digits before allowing a transaction.”<\/p>\n Richard Buckler says fraudulent Origin utility bills could be used as proof of identity, increasing the risk of identity theft after the breach. (ABC News: Matt Roberts)<\/p>\n He said the stolen information could also be merged with data from previous breaches, such as the Qantas cyber attack<\/a>, allowing AI tools to rapidly build increasingly detailed profiles of victims.<\/p>\n “Once this information is out there, it tends to stay out there,” he said.<\/p>\n![\"An](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/07\/835319e74e9f8c89d499d5b6c55f8014.jpeg\")
<\/p>\n![\"Three](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/07\/1784841372_73_ba5144e7c7eac899f9d19c9ed295171d.jpeg\")
<\/p>\n