Australian electricity and gas major Origin Energy is working through the aftermath of a July 2026 data security incident in which a hacker claimed access to personal data on 2 million customers. Origin notified Australian authorities after a sample of 50 customer records surfaced in the press, and its own completed review puts the confirmed figure far lower: approximately 900,000 current and former customers. Investigators have linked the theft to a former Accenture employee working Origin's outsourced billing and customer support account in Manila, who according to multiple reports intended to extort the company for the return of the data. The matter remains an active criminal investigation involving the Australian Federal Police, the Australian Cyber Security Centre and the National Office of Cyber Security.
What Happened
The counts reported for this incident differ sharply depending on who is speaking, and the gap is the single most important thing to understand about it.
The attacker's claim, reported by TechShots (an OTHER-tier outlet) and echoed in the framing of early coverage, was access to personal data on 2 million customers. Origin's own investor and media update, published 21 August 2026, states that approximately 900,000 current and former customers had information subject to unauthorised access, a figure independently reported by ABC News, the Australian Financial Review and Nine. Origin's number reflects a customer-by-customer forensic review that the company describes as "substantially complete"; the 2 million figure is an unverified claim by the person who took the data, and claims of that kind routinely inflate. Readers should treat 900,000 as the confirmed floor and the 2 million claim as attacker assertion, not established fact.
Nine reports the data was accessed on 2 July 2026. CySecurity News reports that Origin became aware of a potential security threat in early July but did not initially treat it seriously, a characterisation that appears in only one OTHER-tier source and is not confirmed by Origin.
The incident became publicly visible when The Australian received a sample of 50 customer records from the hacker, containing names, addresses, email addresses, dates of birth, phone numbers and billing histories. Origin then reported a potential data breach to authorities. By 18 August, ABC News and the AFR had independently reported that the investigation was focused on a former Accenture employee in Manila. Accenture told ABC News it was "not appropriate for us to comment on Origin's data security incident, which we understand remains under active investigation." Origin has declined to confirm the Accenture link, citing the criminal investigation.
What Was Taken
Origin's completed review breaks the exposure into tiers, and the tiers matter more than the headline number:
The bulk population (most of ~900,000 customers): some combination of name, address, date of birth, contact phone number, account details, and other information about the customer's personal circumstances shared with Origin, plus the last four digits of a credit card or the last three digits of a bank account.
Government concession scheme or program numbers: approximately 15,000 customers. This is an underdiscussed category. Concession identifiers tie directly to pensioner, healthcare and low-income status, which is both a privacy harm and a targeting signal for scammers who want a vulnerable, trusting victim pool.
ID document numbers: approximately 100 customers. Nine reports these include driver's licence and passport numbers. Origin stresses these were "the number only, no scanned copies of ID documents were affected."
Full bank account numbers: approximately 60 customers. Confirmed by Origin CEO Frank Calabria and reported by both ABC News and Nine.
Early reporting via TechShots quoted Origin as saying financial details including credit cards and bank accounts did not appear compromised. The completed review qualifies that: for roughly 60 customers, full bank account numbers were in fact accessed. This is a normal and honest evolution of a breach disclosure as forensics complete, but it is worth flagging that the first public reassurance did not survive contact with the final review.
Why It Matters
Origin is one of Australia's largest energy retailers, and this lands in a country that has already absorbed Optus and Medibank in 2022 and Qantas in 2025. The cumulative effect is that a very large fraction of the Australian adult population now has overlapping fragments of identity data circulating. A date of birth from one breach plus an address from another plus a concession number from this one is an identity theft kit, even when no single breach leaked enough on its own.
The second point is structural. If the Manila attribution holds, this was not a perimeter failure, a ransomware crew, or an unpatched edge device. It was a person with legitimate, granted access to customer records at an outsourced service provider, who took the data and tried to monetise it through extortion. Firewalls, EDR and phishing-resistant MFA do essentially nothing against that. The attack surface here was a contract.
Third: the AFR notes that Origin had outsourced key billing and customer support functions to Accenture in Manila. Every organisation that has offshored contact centre or billing operations has the same exposure, and in most cases the downstream provider's access controls are not visible to the data owner in any real-time way. Origin's remediation reflects exactly this, with the AFR reporting that the company has moved to limit internal access to customer files.
The Attack Technique
The AFR reported that the employee, who has since left the consulting firm, "had intended to extort the company for money in exchange for the return of the information," attributed to multiple people briefed on the matter speaking anonymously. ABC News reported the same extortion motive, sourcing it to a Nine report. Both AFR and ABC independently placed the investigation on a former Accenture employee in Manila.
What has not been publicly established: whether the access was within the individual's normal job entitlements or involved privilege escalation, how the records were exfiltrated, over what period, and whether any other party assisted. Origin and Accenture have both declined to comment on specifics while the criminal investigation is open, which is the appropriate posture but leaves the technical picture incomplete.
Treat the attribution as strongly reported rather than officially confirmed. Neither Origin nor Accenture nor the AFP has publicly named anyone, and no charges have been reported in these sources.
What Organizations Should Do
Inventory who outside your company can read your customer records. Not which vendors you have contracts with, but which named individuals at those vendors hold live entitlements to production customer data, and who reviews that list. If you cannot produce this within a day, that is the finding.
Apply least privilege to bulk read access, not just write access. A contact centre agent needs to view one customer's record while on a call with them. They almost never need the ability to enumerate or export thousands. Origin's own response, restricting internal access to customer files, is the correct instinct and should not require a breach to trigger.
Instrument volumetric and behavioural alerting on legitimate accounts. Insider theft looks like normal use at normal times from normal endpoints. The detectable signal is volume, sequence and rate: unusual record counts per session, access to accounts outside an agent's queue, off-pattern hours. Build those detections against your CRM and billing platforms specifically.
Get contractual and technical right of audit over offshore providers. Logging that lives only in the vendor's environment, reviewed only by the vendor, is not a control you own. Push for log forwarding into your own SIEM as a condition of the engagement.
Tighten your offboarding pipeline across the vendor boundary. The reported actor is a former employee. Confirm that a termination at your outsourcer triggers same-day revocation in your systems, and verify it with periodic reconciliation rather than trusting the process.
Segment the sensitive fields. Full bank account numbers, ID document numbers and concession identifiers should not sit in the same flat view as name and address. The fact that this breach's most damaging categories were limited to 60, 100 and 15,000 customers respectively suggests data segmentation worked to some degree at Origin. Design for that outcome deliberately.
For consumers affected: Origin has advised affected customers to watch for scams and has made specialist identity and cyber support services available. Given that concession numbers and partial banking details are in play, the realistic threat is convincing targeted social engineering, not direct account drainage. Treat any unsolicited contact referencing your Origin account as hostile until proven otherwise.
Sources: TECHSHOTS Power Outage: Hacker Claims Access to 2M Origin... | Dozens of Origin Energy customers' full bank details, ID numbers ac... | Origin Energy hack traced to Accenture's Manila call centre - ABC News | Origin hack investigation points to offshore Accenture employee bas... | Origin restricts staff access after data breach as it finalises review | Update On Data Security Incident - Origin Energy | Customer bank account numbers accessed in Origin Energy data ... | Origin Energy Data Breach Traced to Manila Call Centre, Ex-Accentur...