Loading story…
Origin Energy said attackers breached its internal network and stole customer information from its Australian operations. The company said the exposed data may include names, addresses, dates of birth, phone numbers, Origin account details, and partial payment information, including the last four digits of credit cards and the last three digits of bank accounts.
The energy provider has not confirmed how many customers were affected, but a person claiming responsibility reportedly told media outlets that data from 2 million customers was accessed. Origin said it has engaged independent cyber experts, is securing affected systems, and has reported the incident to the Australian Cyber Security Centre, the Australian Federal Police, the Office of the Australian Information Commissioner, and the National Office of Cyber Security, while preparing to notify impacted customers as they are identified.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Origin Energy disclosed that its recent data breach affected 900,000 current and former customers in Australia. The company said the exposed data included names, dates of birth, phone numbers, addresses, account details, and partial payment card or bank account numbers.
Troy Hunt's summary cites reports that Origin Energy and the threat actor came to an agreement after the breach, possibly involving payment or promises tied to deletion of the stolen data. The report also noted that any such arrangement would not guarantee the data was actually deleted.
A threat actor calling themselves 'John Doe' reportedly told local media they would leak allegedly stolen Origin Energy customer data within two weeks unless the company contacted them on Signal to negotiate. The actor also claimed responsibility for the breach.
A person claiming to be the hacker reportedly told media outlets that details from 2 million Origin Energy customers were accessed. Origin Energy said it had not yet confirmed how many customers were affected.
Origin Energy reported the incident to Australian authorities, including the Australian Cyber Security Centre, the Australian Federal Police, and the Office of the Australian Information Commissioner; reporting also said the National Office of Cyber Security was involved in the response or investigation.
Origin Energy confirmed that attackers compromised its internal network and accessed customer data from its Australian operations. The exposed information may include names, addresses, dates of birth, phone numbers, account information, and partial payment data.
Origin Energy said it identified a cyber security incident involving malicious actors, launched an investigation with external cyber security experts, and took immediate steps to secure affected systems.
Origin Energy said it identified suspicious activity affecting portions of its customer information systems on July 22, 2026. The company later investigated the activity as a cybersecurity incident involving unauthorized access and data exfiltration.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
18 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourcecybersecuritynews.com
Open sourcesecurityweek.com
Open sourcetechrepublic.com
Open sourcebleepingcomputer.com
Open sourcetherecord.media
Open sourceoriginenergy.com.au
Open source7news.com.au
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Capital Economics and People's Energy both suffered data breaches in December 2020 that later surfaced in breach disclosures, exposing large volumes of customer information. Capital Economics, an economic research firm, had about **263,000 customer records** compromised, including names, email addresses, physical addresses, phone numbers, job titles, and employer details. People's Energy, a UK power company, had nearly **7GB of data** exposed, affecting **359,000 unique email addresses** along with names, phone numbers, physical addresses, and dates of birth. The breach also exposed staff email addresses and **`bcrypt` password hashes**, although available reporting said no customer passwords were included in the leaked data.
Jun 29, 2026
Optus suffered a major breach that exposed personal information belonging to about 9.8 million current and former customers, including names, dates of birth, addresses, phone numbers, email addresses, and, for roughly 2.8 million people, passport or driver’s licence numbers. Australian officials publicly disputed Optus’s description of the intrusion as sophisticated, citing claims that an internet-exposed unauthenticated API and weak access controls enabled what the cybersecurity minister called a “basic hack,” while the company maintained a skilled criminal was responsible. The incident triggered investigations by the Australian Federal Police, the information commissioner, and ACMA, and intensified scrutiny of telecom-sector cyber oversight and penalties. A BreachForums user claiming responsibility demanded about **US$1 million** and threatened to publish stolen records in batches before later posting an apology and claiming the data had been deleted, a statement authorities did not verify. The fallout included identity-theft warnings, state support for replacing compromised licences, Optus-funded document replacement and credit monitoring, customer backlash over poor communications, and at least one criminal case involving alleged misuse of the stolen data to blackmail victims. The breach also led to a Deloitte review, court fights over disclosure of that report, customer losses, and a large class action as Australia moved to strengthen information-sharing and cyber laws.
Jun 29, 2026
**Endesa** (Enel Group) disclosed unauthorized access to its *Energía XXI* commercial platform, resulting in exposure of customer contract-related personal and financial data. Impacted data types reported include **identification and contact details**, **Spanish national identity numbers (DNI)**, **contract information**, and **payment details including IBANs**; Endesa stated that **account passwords were not exposed** and that there was **no evidence of fraudulent use** at the time of notification. Endesa reported taking containment and investigation steps including **blocking access to compromised internal accounts**, collecting and analyzing logs, and increasing monitoring for suspicious activity while notifying affected customers. The incident was reported to Spanish authorities including the **Spanish Data Protection Agency (AEPD)** and referenced coordination with national cybersecurity bodies; reporting also noted an attacker claim of large-scale SQL data theft and attempted sale on a dark web forum, though Endesa’s public statements emphasized the breach was limited to customer data access and did not involve operational disruption or ransomware.
Jun 29, 2026