Origin has confirmed unauthorised access to and disclosure of some customer data. The immediate financial risk may be limited, but the exposed information could make future impersonation scams much more convincing.
When news of a data breach breaks, most people immediately ask: “Was my credit card number stolen?” That is important, but it is not the only question customers should ask.
A combination of your name, address, date of birth, phone number and account information can help criminals create messages that feel personal, timely and legitimate. A future email may know which company you use. A caller may know your address. A text may refer to an account or payment issue that sounds plausible.
That does not mean every affected person will experience fraud. It means customers should be especially cautious of unexpected Origin-related communication in the weeks and months ahead.
On 23 July 2026, Origin Energy confirmed that there had been unauthorised access to and disclosure of some customers’ data. The company said it was still working to determine the total number of impacted customers and would contact people where it could confirm they were affected.
According to Origin, information that may have been involved includes:
Name, residential address, date of birth and contact phone number.
Information associated with a customer’s Origin account.
The last four digits of a credit card for some affected customers.
The last three digits of a bank account for some affected customers.
Origin has stated that incomplete credit card or bank account information cannot, by itself, be used to make purchases or access accounts.
Modern scams are often less about guessing and more about creating a believable story. The more accurate details a scammer has, the easier it becomes to impersonate an organisation, manufacture urgency and persuade a person to act.
| Exposed information | How it could be misused | What to remember |
|---|---|---|
| Name and phone number | Personalised SMS messages or calls claiming to be from Origin, a bank or a government service. | Knowing your name does not prove the caller is genuine. |
| Address | Messages referring to your property, electricity service, relocation or an alleged disconnection. | Your address can be used to build credibility. |
| Date of birth | Identity-based social engineering or attempts to pass weak security checks. | Do not confirm additional identity information during an unexpected call. |
| Account information | Fake billing, refund, account update or overdue-payment messages. | Access the genuine account independently to check any claim. |
| Last digits of a card or bank account | Used as “proof” that the caller or sender already knows your payment information. | Partial digits are not proof of legitimacy. |
The breach does not automatically mean criminals will contact every Origin customer. However, major incidents often create an opportunity for scammers because people are expecting updates and may be less suspicious of breach-related messages.
%%OZI_ILB_PROTECT_4ed3f63eb9c3d060e443ad6a4f3ace26%%A legitimate-looking message may claim that you must “verify” your identity, update your details or secure your account. The link may lead to a fake Origin login page designed to steal credentials.
%%OZI_ILB_PROTECT_7f9508b3dbfb858261ff4c5e068c5854%%Scammers may exploit anger or concern about the breach by offering compensation, refunds or credit monitoring. Never provide banking details through an unexpected link.
%%OZI_ILB_PROTECT_54ab0970488c52cff6fb5e844b4dd089%%Energy-related threats can be effective because electricity is an essential service. Urgency is the pressure mechanism. Pause and check your account independently.
%%OZI_ILB_PROTECT_17c12234e7354661fde423d7cb9319c0%%A caller may know your name, address or partial account details and claim to be from Origin’s security team. They may then ask you to confirm full card details, provide a one-time code, install remote-access software or transfer money to a “safe account.”
%%OZI_ILB_PROTECT_96967b33c0b1aab2f7929d00947beca1%%A scammer may claim your bank account is at risk because of the Origin incident. They may tell you to move funds, disclose a verification code or approve a transaction. A genuine bank will not require you to transfer money to a so-called safe account.
%%OZI_ILB_PROTECT_b92e53a9dcc4e720046c886d46735f61%%- Do not use the link or phone number in the unexpected message. Even a professional-looking message can contain a fraudulent destination.
- Open a fresh browser window. Type Origin’s official web address manually or use an existing trusted bookmark.
- Check your account independently. Look for bills, alerts, messages or changes inside the genuine account.
- Use official contact information. Obtain the number from Origin’s official website or a trusted bill—not from the suspicious communication.
- Do not share one-time codes. A code sent by your bank or service provider may authorise account access or a transaction.
- Check suspicious links before opening them. A verification tool can highlight warning signs, but the final confirmation must still come from the organisation itself.
- Watch for direct communication from Origin about whether your information was affected.
- Use a strong, unique password for your Origin account.
- If that password was reused elsewhere, change it on those other accounts as well.
- Enable multi-factor authentication wherever it is available, especially for email and financial accounts.
- Review your Origin account and payment information for unexpected changes.
- Monitor bank and card activity and report unfamiliar transactions promptly.
- Be cautious of unexpected calls, texts or emails referencing the breach.
- Tell family members who manage or share the household account about the risk of follow-up scams.
- Keep suspicious messages so they can be reported, but do not interact with their links or attachments.
Close the page. Do not download anything. Update your browser and device, and run a scan using reputable security software if the page triggered a download or behaved unexpectedly.
%%OZI_ILB_PROTECT_0cd562544e16fe1e55c02af91e024901%%Access the genuine Origin website independently and change the password immediately. Change it anywhere else you reused it. Secure the email account connected to your Origin account as well, because email access can be used to reset other passwords.
%%OZI_ILB_PROTECT_9bf13dedcaa55f82ede0d19a8dd88a28%%Contact your bank using the number on the back of your card or through its official app. Explain exactly what information was shared and follow its fraud-prevention instructions.
%%OZI_ILB_PROTECT_4991caa0a7554d4391dbc63d3af5b58e%%Contact the relevant bank or service provider immediately. One-time codes are time-sensitive and may be used to approve access or transactions.
%%OZI_ILB_PROTECT_eeaa96645e9618991dbca50b800388f6%%Disconnect the device from the internet and contact your bank from a different trusted device. Seek professional technical support before reconnecting the affected device.
%%OZI_ILB_PROTECT_053cd8f5fb1c9a851ccada341357774d%%Consider contacting IDCARE, Australia and New Zealand’s national identity and cyber support service, for tailored guidance.
%%OZI_ILB_PROTECT_669f8f48b85d025c136e09943ea9e3e4%%OziShield is a free, privacy-first scam verification support platform. It can help identify warning signs in suspicious links, website addresses, SMS text and QR codes before you interact with them.
For example, OziShield may identify unusual domains, imitation brand names, suspicious redirects, misleading subdomains and other risk indicators that are easy to miss on a mobile screen.
However, OziShield does not replace Origin, your bank, Scamwatch, law enforcement or official identity-support services. It cannot guarantee that a message is safe or definitively authenticate a sender.
Check the link or message for warning signs with OziShield, then confirm the request independently through Origin’s official website or app.
Verify before you trust.
Check with OziShieldHow to report a suspicious message
Depending on what happened, you may need to contact more than one organisation:
- Origin Energy: Report suspected Origin impersonation using contact details obtained from its official website.
- Your bank: Contact it immediately if payment information, passwords, security codes or money were involved.
- Scamwatch: Report the scam to help authorities identify patterns and warn the community.
- ReportCyber: Use the Australian Government reporting service where cybercrime or financial loss has occurred.
- IDCARE: Seek support if identity information may have been compromised or misused.
Frequently asked questions
Was every Origin customer affected?
No confirmed total was available when this article was published. Origin said it was working to determine the number of impacted customers and would contact people where it could confirm they were affected.
Were full credit card or bank account numbers exposed?
Origin said affected information may include the last four digits of a credit card or the last three digits of a bank account. It stated that this incomplete information cannot be used by itself to make purchases or access accounts.
Should I cancel my card immediately?
Not necessarily. Contact your bank for advice if Origin confirms your data was affected, if you notice unfamiliar activity, or if you disclosed additional financial information to a suspicious caller or website.
How will Origin contact affected customers?
Origin has said it will contact customers where it can confirm they were affected. Regardless of how a message arrives, access your account independently or contact Origin through details from its official website before acting.
Does a message knowing my address mean it is real?
No. Personal details may come from a data breach, public records, social media, marketing databases or previous scams. The accuracy of the information does not authenticate the sender.
Can scammers spoof an Origin sender name or phone number?
Yes. Sender names, email display names and caller ID information can be manipulated. Do not rely on the name shown on your screen as proof.
Can OziShield confirm an email came from Origin?
No. OziShield can assess links, websites and message content for risk indicators, but official communication should be confirmed directly through Origin’s trusted channels.
Final reminder
The most dangerous part of a data breach may not be the first incident. It can be the believable communication that follows.
A scammer who knows your name, address or partial account details may sound informed, but that does not mean they represent Origin, your bank or any government agency. Slow down, avoid the supplied link, and confirm the request independently.
After a breach, verification matters more than familiarity. Verify before you trust.
Official and reporting sources
Origin Energy, “Update on data security incident”, 23 July 2026:
https://www.originenergy.com.au/about/investors-media/update-on-data-security-incident/
Origin Energy, July 2026 security incident update:
https://www.originenergy.com.au/update-july-2026/
Australian Cyber Security Centre:
https://www.cyber.gov.au/
Scamwatch:
https://www.scamwatch.gov.au/
IDCARE:
https://www.idcare.org/
Not sure if a link, message or document is real?
Paste it into the free OziShield scanner — instant forensic analysis.
No login. No account. No cost. Takes 10 seconds.