The alleged hacker who claimed access to two million Origin Energy customer records says a private settlement has been reached with the company and no data will be published. Origin has separately confirmed that customer data was accessed and disclosed.
"We took our site down, we already settled everything with Origin energy privately and no data will be leaked," the person, using the name Edison Walthour, told The Australian, reversing an earlier threat to leak the data within 14 days. Origin has been contacted for comment on the settlement claim. The report is available at The Australian (paywalled).
Origin issued a further statement to the ASX on Thursday afternoon confirming "there has been unauthorised access and disclosure of some customers' data". The company said this included the last four digits of some credit cards and the last three digits of some bank account numbers. A day earlier it had said it did not believe such information was affected. Origin has about 4.8 million customers.
Chief executive Frank Calabria apologised to customers on Thursday, saying he was "sorry this has happened".
The person, who said they were Australian, told The Australian they used an employee logon to reach Origin's customer management system, supplied by Kraken. They claimed three weeks of undetected access to customer tools before extracting the data, and said Origin later dismissed the employee whose credentials were used. Origin declined to comment on the alleged sacking.
Asked how the credentials were obtained, the person cited weak internal controls. "No company VPN (virtual private network), very simple passwords, everything is so readable and predictable they don't care at all," they said. They gave Origin's offshoring of customer service roles as their motivation. Origin runs a hybrid support model with staff in Australia and outsourced providers in Manila, and completed two redundancy rounds tied to the offshoring last year.
How the claim surfaced
The person first contacted Origin on 2 July, approaching board members, security teams and customer care staff. They went to the media after almost three weeks without resolution. Origin began investigating on Wednesday after The Australian forwarded a sample of 50 customer records. The company then notified the Australian Federal Police, federal cyber and privacy authorities and the ASX.
The sample contained names, emails, phone numbers, addresses, billing history and dates of birth. The person also claimed access to incomplete credit card and bank numbers. No ransom demand had been reported before the settlement claim.
Under the Privacy Act, companies face penalties of up to $50 million or 30 per cent of revenue for serious data mishandling. Origin reported revenue of almost $8 billion for the six months to 31 December, which The Australian calculated as a potential maximum exposure of $2.34 billion.
The claim follows a breach of a Qantas call centre database. The Office of the Australian Information Commissioner said last week that preliminary inquiries showed the airline had not failed in its responsibility to protect personal data. The regulator logged 1,205 data breach notifications in 2025, an 8 per cent rise on the prior year.