Origin Energy has put firmer numbers around the most sensitive information exposed in its July cyber breach, confirming that approximately 60 customers had their full bank account numbers accessed, while about 100 customers had ID document numbers exposed.
The figures add an important layer to a breach affecting roughly 900,000 current and former Origin customers. For most people caught up in the incident, the information accessed was broader personal data rather than complete banking details. That distinction matters because the final picture is more complicated than a single headline number suggests.
The incident has also moved beyond customer notifications and cybersecurity measures. Origin’s board has reduced chief executive Frank Calabria’s remuneration by $357,000, while reductions for other members of executive management totalled $607,000, linking the breach directly to executive accountability.
What information was actually accessed?
Origin’s review found different levels of exposure across the affected customer base.
For approximately 60 customers, the information accessed included a full bank account number, rather than only a shortened or masked account reference. Around 100 customers had an ID document number accessed. Origin said this involved the document number itself and that scanned copies of identification documents were not affected.
Numbers associated with government concession schemes or programs were also accessed for approximately 15,000 customers.
For the wider group of roughly 900,000 affected current and former customers, the information varied from person to person. It could include a combination of names, addresses, dates of birth, contact phone numbers, account information and details relating to customers’ personal circumstances.
In some cases, the data included the last four digits of a credit card or the last three digits of a bank account.
That means the breach did not expose the same information for every affected customer. The smaller groups involving complete bank account numbers, ID numbers and concession-related numbers sit within a much larger population whose exposed information differed according to the individual record.
Why the latest review matters?
When the breach first became public, customers knew that a large volume of personal information had been accessed, but the precise exposure for each person was still being established.
Origin now says it has substantially completed its customer-by-customer review and is working through more specific notifications. Those notices are intended to tell affected people exactly which information was accessed, what practical steps they can take and what support is available.
This is a significant difference from simply knowing that 900,000 people were affected.
For an individual customer, the relevant question is no longer only whether their details were part of the breach. It is which details were accessed.
Someone whose record included a full bank account number faces a different set of concerns from somebody whose exposed information was limited to contact details and partial financial information.
Has the accessed data been published?
Origin has said the alleged hacker had not leaked or publicly disclosed customer data at the time of its latest update.
That does not remove the need for caution. Origin has advised customers to watch for suspicious activity and to be particularly wary of calls, messages or emails that appear to come from the company, a bank or government agency.
Affected customers have also been offered specialist support, including identity monitoring and 12 months of free credit monitoring.
Customers have additionally been encouraged to use measures such as two-factor authentication and to avoid providing personal information in response to unsolicited online approaches.
Where does the investigation stand?
The criminal investigation remains active.
Authorities have traced the incident to a call centre in the Philippines, with the investigation linking the breach to a former Accenture employee in Manila. Accenture works with Origin in operating call centres.
Origin has said it is working with the federal government, the Australian Cyber Security Centre, the National Office of Cyber Security and the Australian Federal Police.
Because the criminal investigation is continuing, the available information does not establish a final legal finding about responsibility for the breach.
The breach is now hitting executive pay
One of the less obvious consequences has emerged inside Origin’s own executive remuneration.
The company’s board decided to reduce executive bonuses in recognition of what it described as shared accountability, the number of customers involved and the importance of protecting Origin’s systems and customer information.
Calabria’s remuneration was reduced by $357,000, while reductions applied to other executive management totalled $607,000. The board has also left open the possibility of considering further financial consequences after outstanding reviews and investigations are completed.
That makes the breach more than a cybersecurity response exercise. It has become an executive accountability issue as well.
What Origin customers should take from the update
The number that attracts the most attention is 900,000, but it does not tell the whole story.
The latest review shows several distinct groups within that total: approximately 60 customers with full bank account numbers accessed, around 100 with ID document numbers accessed, and about 15,000 affected through government concession or program numbers. The remaining affected records involved varying combinations of personal and account-related information.
For customers, the most useful information will therefore be the individual notification from Origin explaining exactly what was contained in their record.
For Origin, the immediate task is broader. It must finish those notifications, continue supporting affected customers and respond to an investigation that remains unresolved.
Calabria has said the company has taken additional measures to strengthen its systems and prevent a similar incident. Origin has also urged customers to remain alert for suspicious activity while the investigation continues.
The breach may have affected hundreds of thousands of people, but the latest findings show why that headline number needs context. The information exposed was not uniform, and for a smaller number of customers, the data accessed went considerably further than partial account details.
