‘No evidence’ Origin Energy customer data leaked to the dark web

• Origin Energy says it has “no evidence” that customer data accessed during a cyberattack in July has been posted on the dark web.
• The chair of Australia’s biggest energy company addressed shareholders at the company’s AGM this morning, giving a brief update on the hack.
• Origin admits that the “risk remains” that the data of approximately 900,000 current and former customers could be published.

Origin Energy says it has “no evidence” that the data of approximately 900,000 current and former customers accessed during a cyberattack in July has been posted to the dark web.

Addressing shareholders at the company’s AGM this morning, company chair Scott Perkins said “the risk remains” that data could be published.

“Customers place enormous trust in Origin to protect their information and we do not take that for granted,” Perkins said.

“We have apologised to customers who were affected while providing support and taken a number of steps to enhance the security of our systems to prevent future incidents of this kind.

“We have seen no evidence of the information being published on the internet or the dark web to date; however, we note this risk remains and affected customers will need to remain vigilant to any suspicious activity or scams.”

In late July, Origin alerted customers that it had detected unauthorised access to customer data.

A later review found that the hack exposed the data of about 900,000 current and former customers, including names, addresses, dates of birth and phone numbers.

Of the affected customers, 60 had their full bank account number accessed, while a further 100 customers had an ID document number accessed.

Origin has not identified the culprit and has referred its findings to police for criminal investigation.

Subscribe here for our FREE Tuesday and Thursday newsletter

Email address

Subscribe

Today, Perkins said Origin was not alone in facing the ongoing threats to its data security.

“Unfortunately, individuals and businesses, no matter where they are around the world, face a growing threat from this sort of criminally motivated cyber activity,” he said.

“The threat environment is constantly evolving, and we will have to work hard to continue to protect the security of our systems and our customers’ information. We are committed to that.

“I would also like to acknowledge the diligence and care for our customers evident in management’s response to this incident.”

The nation’s largest energy company faced criticism after it revealed it had known about potential access for almost a month, in early July, before making the information public.

It defended its perceived lack of urgency, saying initial investigations into the access did not find it a “credible threat”.

CEO Frank Calabria, who was the face of Origin’s response to the hack, did not address the incident at all in his address to the AGM today.