About 900,000 Origin Energy customers affected by hack as company admits it was warned weeks before public told | Australia news
Origin Energy admitted it was warned about the attack, which accessed the personal data of 900,000 current and former customers, three weeks before it first publicly disclosed the data breach.
Australia’s largest energy retailer said a “significant” number of its 900,000 people were former customers and those affected would be notified in the coming days.
Origin said the data could include customers’ names, addresses, dates of birth, phone numbers and account information, as well as the last four digits of a credit card or the last three digits of a bank account.
The company has 4.8 million customer accounts in Australia and provides electricity, fossil gas, LPG and internet services to homes and businesses.
Origin’s CEO Frank Calabria told reporters the company was still reviewing the incident.
“We are sorry,” Calabria said Tuesday. “We do not take for granted the trust customers place in Origin and we are here to support them.”
Calabria warned its customers to be wary of suspicious activity and the increased risk of fraud.
It said Origin received emails on July 2 from someone claiming to have accessed customer records. He said the company did not determine it was a credible threat because there was no evidence that data had been accessed.
Calabria said Origin received evidence that customer data had been accessed on July 22, at which point it announced the hack.
It said “historical data” had been accessed “without permission” and that Origin was working to secure its system to prevent similar incidents. He said the company does not believe any information was placed on the dark web.
Calabria refused to answer a series of questions about when the violations occurred; Whether Origin personnel have been determined to have played a role in the breach; whether a ransom was requested, paid, or contemplated; and whether the leak risk is “alive” or resolved.
“This is a criminal matter that is under active investigation and as such we are limited in the level of information we can provide at this time,” he said.
The company last week denied reports that it had reached a deal with its hacker to prevent data leaks, after Australia published allegations on Friday from a person claiming to be behind the hack.
“Origin notes that there has been significant media speculation regarding the data security incident, which we are actively managing. Our investigation is ongoing and we have no further updates at this time,” an Origin spokesperson said in a statement on Friday.
