Origin Energy has launched an urgent investigation into a potential cyber security incident after an individual claiming to be a hacker alleged they had gained access to the personal information of around two million customers, prompting Australia’s largest integrated energy retailer to notify customers and federal authorities.

The company contacted customers early on Thursday, advising them that it was investigating what it described as a “potential data security breach” and apologising for the uncertainty while forensic inquiries continue.

Executive General Manager Jonathan Briskin said Origin was informing all customers as a precaution while investigators worked to determine the nature and scope of the incident.

“We are contacting all Origin customers as a precaution while we conduct a thorough investigation into the potential impact of this incident,” Mr Briskin said in an email sent to customers.

Importantly, Origin said it does not currently believe the incident involves customers’ financial information.

“We do not believe the impacted information includes customer credit card or bank details,” Mr Briskin said.

He also apologised for the concern caused by the incident.

“We sincerely apologise for the uncertainty this may cause while we carry out our investigation.”

The investigation began after a person claiming to have compromised Origin’s systems contacted The Australian, alleging they had obtained approximately two million customer records after the company failed to respond to repeated attempts to alert it to the issue.

According to the publication, the alleged hacker supplied a sample containing 50 customer records that included names, email addresses, residential addresses, dates of birth, telephone numbers and billing history. The individual claimed these records formed only a small portion of a much larger dataset.

Origin has not confirmed that the sample records originated from its systems, and at this stage the company says investigations remain ongoing.

In a statement released to the Australian Securities Exchange (ASX), Origin confirmed it was urgently examining a potential cyber security incident that may have involved unauthorised access to customer information.

The company stressed that determining exactly what information may have been accessed remains a priority and said it would continue providing updates as more facts become available.

Origin has also notified the Australian Cyber Security Centre (ACSC), the Australian Federal Police (AFP) and the Office of the Australian Information Commissioner (OAIC), reflecting the seriousness with which the company is treating the matter.

External cyber security specialists have been engaged to assist with forensic investigations into the alleged breach and to determine whether customer data was actually exfiltrated from Origin’s systems.

The company supplies electricity, natural gas, LPG, internet services and renewable energy products to almost five million customers across Australia, making it one of the country’s largest energy retailers.

If the hacker’s claims are ultimately verified, the incident would rank among Australia’s most significant corporate data breaches in recent years.

However, authorities have emphasised that the investigation is still in its early stages, and the claimed scale of the breach has not been independently confirmed.

Although Origin believes payment card and banking information has not been affected, cyber security experts note that other personal information can still present significant risks if obtained by criminals.

Names, addresses, dates of birth, telephone numbers and billing histories may be used to create highly convincing phishing emails, SMS messages or phone scams that appear legitimate.

Fraudsters frequently combine personal information from multiple breaches to impersonate trusted organisations, making it easier to deceive victims into revealing passwords, one-time verification codes or financial details.

For that reason, Origin is encouraging customers to remain vigilant for unexpected emails, text messages or phone calls claiming to be from the company.

Customers are advised not to click on suspicious links, provide passwords or verification codes, or disclose banking information unless they have independently confirmed they are communicating through official Origin channels.

The incident also highlights the growing cyber security challenges facing Australia’s critical infrastructure providers.

Over recent years, several major Australian organisations have experienced high-profile cyber incidents affecting millions of customers, including telecommunications companies, health insurers, airlines and financial service providers.

These breaches have prompted governments and regulators to strengthen mandatory reporting obligations, increase penalties for serious privacy failures and encourage organisations to improve cyber resilience.

Australia’s Privacy Act requires organisations regulated under the Notifiable Data Breaches scheme to notify affected individuals and the Privacy Commissioner when an eligible data breach is likely to result in serious harm.

The current Origin investigation will determine whether the incident ultimately meets that legal threshold.

Cyber security has become an increasingly important issue for companies operating critical infrastructure, including energy providers responsible for supplying essential services to millions of Australians.

Recent reforms under the Security of Critical Infrastructure Act have expanded obligations on operators to strengthen cyber defences and improve incident reporting to government agencies.

While the latest incident appears to involve customer information rather than operational energy systems, it nevertheless demonstrates the growing attractiveness of large consumer databases to cyber criminals seeking valuable personal information.

According to the ACSC, phishing, credential theft and data extortion remain among the most common tactics used by cybercriminal groups targeting Australian organisations.

Even where financial information is not obtained, compromised personal details can remain valuable on criminal marketplaces because they may facilitate identity theft or support future fraud campaigns.

Origin has said its investigation remains ongoing and that it will continue updating customers as more information becomes available.

The company has not indicated whether any ransom demand has been received, nor has it confirmed the identity or motivations of the individual claiming responsibility for the alleged breach.

At present, the central questions remain whether customer information was successfully extracted, how many individuals may have been affected, and whether any additional protective measures will be required once forensic investigations are complete.

Until those questions are answered, Origin customers are being encouraged to monitor communications carefully, remain alert for scam activity and rely only on official company channels for updates regarding the investigation.