Origin Energy — Data breach disclosed August 2026

New incident
Not stated
Verified from two or more independent sources

What this record states

Origin Energy has reported a data breach.

The source states that information about customers was involved, across 1 category of personal information.

No source consulted for this record states when the incident occurred.

People affected: 900,000, estimated by the source.

Record overview

Incident date: Not confirmed
Discovery date: Not confirmed
Disclosure date: 21 August 2026
Notification date: Not confirmed
People affected: 900,000, estimated by the source
Who was affected: customers

Each date is either established by a quoted source or explicitly not confirmed.

Affected people and data

Categories of affected data

customer files

Notifications and response

Regulators notified

Office of the Australian Information Commissioner
OAIC

Law enforcement notified

Australian Cyber Security Centre
Australian Federal Police

Legal and formal response

Not stated

Technical and organisational remediation

Not stated

Official sources

Corroborating report

Origin Energy data breach prompts staff restrictions on access to customer details

afr.comRetrieved 21 August 2026

View official source

Further official sources

Corroborating report

Origin Energy warns customers after revealing new details of July breach affecting 900,000 Aussies | 7NEWS

7news.com.auRetrieved 22 August 2026

View official source

Corroborating report

Origin Energy data breach: Dozens of full customer bank account details accessed in cybersecurity incident | Nine.com.au

nine.com.auRetrieved 23 August 2026

View official source

Corroborating report

Origin Energy reveals full bank account numbers exposed | Information Age | ACS

acs.org.auRetrieved 26 August 2026

View official source

Corroborating report

Origin Energy data leak cybersecurity lessons have experts worried - ABC News

abc.net.auRetrieved 26 August 2026

View official source

Cleverer commentary

This section is commentary by Cleverer, not reporting, and is not drawn from the sources cited above.

Cleverer Insight

The record establishes that Origin Energy notified current and former customers about unauthorised access to customer information. It does not publicly establish the incident or discovery date, the number of affected people, the specific information accessed, or whether regulators or law enforcement were notified.

The evidence describes an unauthorised-access incident involving customer information, but records the incident type as unknown. It illustrates the limits of the available public record: customer impact is identified, while the method, scope, cause, response and remediation are not established here.

How Cleverer may have helped

For this kind of failure, current access controls, staff training, documented response procedures and evidence of oversight may help an organisation assess what happened, identify affected people and support timely, accurate communications. Maintaining records of decisions, notifications, control reviews and remediation could make later governance and assurance easier.

None of these measures would necessarily have prevented the incident. They may, however, help establish what was known, what steps were taken and whether reasonable safeguards and response processes were operating, subject to the facts and obligations applicable at the time.