Origin 'hacker' blasts energy giant's weak security and its decision to offshore staff: 'They don't care at all'

By ALASDAIR BELLING and AUSTRALIAN ASSOCIATED PRESS Published: 03:31, 24 July 2026 | Updated: 03:46, 24 July 2026 A 'hacker' claiming responsibility for the Origin Energy cybersecurity incident said they broke into the provider because it moved operations offshore. The Sydney-based company said on Thursday it was working to understand how many of its almost five million customers were affected by the data breach.  Names, addresses, dates of birth, phone numbers and account information may have been accessed in the breach, Origin said in an ASX statement.  Also at risk were the last four digits of credit cards and the last three digits of bank accounts.  On Thursday night, the alleged hacker - who uses the name Edison Walthour - said no data would be published but provided insight on how they carried out the incident.  'We took our site down, we already settled everything with Origin Energy privately and no data will be leaked,' they said.  '[Origin had] no company VPN, very simple passwords, everything is so readable and predictable they don't care at all. 'School projects have better security sometimes'.  The data of over two million customers was compromised in a cyberattack on Origin Energy  Pictured, an email Origin sent to customers after cyberattack reports  The alleged hacker said no data would be published but provided insight on how they carried out the incident  Walthour claimed they targeted Origin because the energy provider had offshored Australian jobs.  'I had access to their customer tools for three weeks, and their IT team didn't detect anything before I managed to dump the data of two million users,' they said. 'I did this because Origin hires customer care agents offshore to save money.' The alleged hacker claimed they had contacted Origin with the stolen information on July 2 but the energy provider had ignored their approaches for three weeks. 'The people in Asia work hard but get underpaid heavily,' they added.  'They don't care about customer security at all. They just care about saving money.' The Daily Mail has contacted Origin for comment. Origin had previously said it did not believe credit card and bank account information was part of the breach. However, in a statement on its website on Thursday, the provider confirmed this had been accessed.  Origin CEO Frank Calabria apologised to customers on Thursday  Should big companies be punished for prioritising cost-saving over customer security? What's your view?'For affected customers, impacted data may include name, address, date of birth, contact phone number and account information, as well as the last four digits of a credit card, or the last three digits of a bank account,' the statement said. 'Incomplete credit card or bank account information cannot be used to make purchases or access accounts'. Only after being contacted by The Australian on Wednesday - which sent a sample of 50 customer records provided by the alleged hacker - did Origin launch an investigation.  Origin chief executive Frank Calabria confirmed the data breach and apologised to customers in a statement released via the ASX on Thursday. 'I'm sorry this has happened. Customers trust Origin with their information, and I apologise for the impact this may cause,' he said. 'One of our key priorities is taking action to secure our systems and ensure no further unauthorised access.' Origin Energy is the biggest energy provider in Australia, supplying nearly five million customers with electricity and gas, as well as LPG, solar and internet services.  The breach represents the country’s most high-profile cyber incident since Partnered Health, owned by private equity firm Quadrant, said earlier in July that its medical records were breached at clinics in Sydney, Melbourne and Canberra.  In 2025, Qantas said it had customer data published by cybercriminals, while telco giant Optus and health insurer Medibank were hit in attacks in 2022 that sparked cyber-resilience laws.