Origin Energy data breach: facts and customer support

Updated 11 September 2026. This AI-assisted guide was prepared by Sam at Scam Checker using the official sources below. Scam Checker is independent of Origin Energy.

Our July coverage is superseded by the later company update below. We have removed the unverified two-million-record figure from the summary, outdated support advice and blanket claims that every compensation message is fraudulent. The original publication date and URL remain unchanged.

Origin Energy data breach: the confirmed update

Origin's 21 August notice identifies approximately 900,000 current and former customers. Its review of affected information was substantially complete; individual notices specify what applies to each customer.

Contact, account, personal-circumstances information and partial payment digits were involved. Smaller, potentially overlapping groups included full bank numbers (about 60 customers), ID numbers (about 100) or concession/program numbers (about 15,000). The ID/concession findings concern numbers, not document scans.

Support includes IDCARE and 12 months of free Equifax Protect credit monitoring. Incident contacts: +61 8 9922 7000 and hello@origin.com.au. Check current arrangements through the official page.

Origin advises affected customers to reset My Account passwords promptly, change reused passwords and enable two-step authentication where available. Open its official website yourself.

Unauthorised access was first confirmed on 23 July.

Verify the specific message before acting

A familiar display name, address or logo is not authentication. The ACSC explains email impersonation and spoofing: criminals can forge sender information or use compromised accounts. A message containing a real account detail still needs independent verification.

Close the message and open a known official website yourself. Obtain contact details there or from a bill you already trust, rather than using a number or sign-in button inside the unexpected message. Ask whether the organisation sent that exact notice and what action, if any, is required.

When checking a support offer, separate these questions:

• Is there a real support programme? Read the official announcement.
• Does it apply to me? Ask through the verified contact route.
• Is this the genuine enrolment process? Verify its destination and requirements before providing information.

A real programme does not make every message about it authentic. Equally, a support offer is not automatically a scam simply because it arrived unexpectedly. Do not pay an unsolicited sender or disclose passwords, security codes or private enrolment details while trying to establish legitimacy.

A fictional example to practise with

Invented teaching example: “Your breach protection expires tonight. Pay an activation fee at origin-support-renewal.invalid and reply with your banking password.”

This is not an Origin notice or a report of a new campaign. The .invalid address is reserved for examples.

The useful questions are about the requested action: why is the sender demanding a password, why is payment needed, and can the instruction be confirmed independently? Do not visit the example address or test a suspicious real link with personal information. A professional-looking page would not resolve those questions.

If you already clicked, shared information or paid

Write down what happened and keep the relevant message, dates and transaction details. A click alone does not establish that an account was accessed; distinguish opening a page from entering a password, downloading software or authorising a payment.

If you disclosed a password, change it through the genuine service and address other accounts where it was reused. Enable multi-factor authentication where available. If money or payment details were involved, contact your bank promptly through a verified channel and explain exactly what you shared or authorised.

For a notification about exposed identity information, review its specific data categories and protection instructions. The OAIC's data-breach guidance explains personal-information risks and response steps. Avoid assuming that every affected customer needs identical action.

You can report scams to Scamwatch and use ReportCyber for cybercrime reporting. Reporting does not guarantee recovery. Our after-a-scam checklist can help organise the next steps without replacing advice from the affected organisation or your bank.

What a checker result can tell you

Our free message checker can help identify warning signs in text. Remove personal details, passwords, security codes and private enrolment information before using it.

Scam Checker cannot determine whether your information was included in this incident, authenticate an Origin letter or guarantee detection of a particular scam. A low-risk result is not permission to pay, log in or share information. Use the independent verification process above even if the text looks convincing or a checker finds few warning signs.