Executive Summary
In July 2026, Origin Energy Limited (ASX-listed Australian energy retailer) disclosed a customer data incident affecting approximately 900,000 current and former accounts.
On 22 July, Origin said it was investigating potential unauthorized access, initially did not believe card or bank details were impacted, and engaged the Australian Cyber Security Centre (ACSC), the Australian Federal Police (AFP), and the Office of the Australian Information Commissioner (OAIC). On 23 July, it confirmed unauthorized access and disclosure—name, address, date of birth, phone, account information, and the last four digits of a card or last three digits of a bank account—and stated that incomplete payment details cannot be used to make purchases. On 28 July, Origin said approximately 900,000 accounts were believed accessed, issued a CEO apology, described customer supports, and stated the matter was under criminal investigation, with a threat under review since early July.
On 21 August, Origin said the review was substantially complete and that approximately 900,000 customers had been contacted. Subsets disclosed: approximately 60 full bank numbers; approximately 100 ID document numbers (no scans); approximately 15,000 concession numbers (no scans). Supports included IDCARE and 12 months of Equifax Protect. Origin’s FAQ stated there was no evidence of internet or dark-web publication.
ABC (18 August) and the Australian Financial Review reported an investigative focus on a former Accenture employee tied to a Manila call-centre supporting Origin. That is not Origin-confirmed attribution and should be treated as investigative reporting under an active criminal inquiry.
As of 14 September 2026: OAIC was engaged per the company, with no public determination found; the criminal investigation remained ongoing per the last 21 August notices; and no public IoCs, CVE, or ATT&CK mapping had been published by Origin, AFP, or ACSC.
TPRM takeaway: this is a population-scale energy-retailer customer-data event highlighting privileged BPO / offshore call-centre access risk to CRM and billing data.
Technical Information
Approximately 900,000 accounts were in scope; Origin indicated that additional other contacts may have been accessed. Public timeline: early July threat review → 22–28 July disclosures → 18–21 August Manila/Accenture reporting and the subset update. No public IoCs or malware have been published.
This advisory does not invent ATT&CK IDs.
Affected Product Versions
N/A — this is not a CVE or product-build advisory. The named organization is Origin Energy Limited.
Workaround and Mitigation
Customers: monitor Origin’s incident page at https://www.originenergy.com.au/update-july-2026/; contact +61 8 9922 7000 or hello@origin.com.au; take up IDCARE / Equifax offers; remain vigilant for follow-on scams.
Organizations:
- Inventory BPO / call-centre production access to utility PII.
- Enforce joiners-movers-leavers and privilege controls.
- Apply data minimisation and masking.
- Put assurance asks to shared BPOs covering July–August 2026.
- Monitor for a secondary phishing wave.
- Contract for access-revocation evidence and bulk-query monitoring seeds.
Indicators of Compromise
No public indicators of compromise have been published as of this advisory. Treat that as an honest empty set and validate any future indicators before enforcement.
References
- Origin Energy, Update July 2026 — https://www.originenergy.com.au/update-july-2026/
- Origin Energy, “Update On Data Security Incident,” 2026-08-21 — https://www.originenergy.com.au/about/investors-media/update-on-data-security-incident-aug21/
- ABC News, “Origin Energy data breach 900k customers impacted,” 2026-07-28 — https://www.abc.net.au/news/2026-07-28/origin-energy-data-breach-900k-customers-impacted/106961804
- ABC News, “Origin Energy hack traced to Accenture’s Manila call centre,” 2026-08-18 — https://www.abc.net.au/news/2026-08-18/origin-energy-hack-traced-to-accenture-manila-office/107049188
- ABC News, “Origin Energy says bank account details of 60 customers accessed,” 2026-08-21 — https://www.abc.net.au/news/2026-08-21/origin-energy-hack-update-60-customers-bank-account-access/107062636
- BleepingComputer, “Australian energy provider Origin says data breach exposes client data,” 2026-07-23 — https://www.bleepingcomputer.com/news/security/australian-energy-provider-origin-says-data-breach-exposes-client-data/
- Information Age, “Origin Energy reveals full bank account numbers exposed,” 2026-08-24 — https://ia.acs.org.au/article/2026/origin-energy-reveals-full-bank-account-numbers-exposed.html
- Australian Financial Review, “Origin hack investigation points to offshore Accenture employee,” ~2026-08-17–21 — https://www.afr.com/technology/origin-hack-investigation-points-to-offshore-accenture-employee-20260817-p60oxo
Third-Party Risk Bridge: BPO Access to Energy-Retailer CRM
The TPRM issue is access governance for energy-retailer CRM via customer-service, BPO, and offshore paths—not CVE theatre. Inventory vendor access; verify terminated-workforce revocation; and demand bulk-query monitoring evidence.
Book a demo to see how Rescana maps privileged BPO and call-centre access into utility CRM and billing data, and whether joiner-mover-leaver revocation and bulk-query monitoring are evidenced before residual third-party risk is closed.
Forward this advisory to your TPRM / vendor-risk owner for energy, utility, or BPO maps overlapping Origin in July–August 2026.
