Key takeaways

  • Origin Energy (ASX:ORG) disclosed on 22 July 2026 that it is investigating a potential security incident that may involve unauthorised access to some customers' data.
  • The company said it does not believe the impacted data includes customer credit card or bank details.
  • Origin said its investigation is proceeding as a matter of urgency and that it has notified relevant authorities.
  • The company has engaged the Australian Cyber Security Centre, the Australian Federal Police and the Office of the Australian Information Commissioner.
  • Shares in the company were trading up 3.0% at A$11.20 on 23 July 2026.

Origin Energy Limited (ASX:ORG) is one of Australia's largest integrated energy companies, supplying electricity and natural gas to millions of residential and business customers and operating substantial electricity generation assets. The company recently disclosed to the ASX that it is urgently investigating a potential security incident involving its systems, having notified the Australian Cyber Security Centre, the Australian Federal Police and the Office of the Australian Information Commissioner. Shares in Origin Energy were trading up 3.0% at A$11.20 on 23 July 2026. The disclosure, made on 22 July 2026, was deliberately measured: Origin confirmed an investigation is underway but did not specify the number of customers potentially affected or confirm whether personal financial details had been compromised, stating that the investigation remains ongoing and that it will provide further updates as the situation becomes clearer.

What Origin Energy has disclosed

In its announcement, Origin Energy said it is "currently investigating a potential security incident which may involve unauthorised access to some customers' data." The company added: "We do not believe the impacted data includes customer credit card or bank details."

The language used is careful and preliminary. Origin described the matter as a "potential" incident and referred to access that "may" have occurred, indicating that the investigation was still in its early stages at the time of the disclosure. The company said its investigations were proceeding "as a matter of urgency."

Origin also acknowledged the concern such a situation can create, stating: "We understand an incident like this may raise concerns and acknowledge the impact of this uncertainty on Origin customers."

The announcement was authorised for release to the ASX's Company Announcements Office by Origin's Company Secretary, Helen Hardy. The release listed media and investor contacts and identified the company by its registered details, including its head office at Level 32, Tower 1, 100 Barangaroo Avenue, Barangaroo, New South Wales.

Importantly, the disclosure did not specify the number of customers potentially affected, the categories of data that may have been accessed, the systems involved, or how any unauthorised access may have occurred. Origin committed only to providing "further updates as appropriate" as its investigation continues. In keeping with the company's own approach, this article does not speculate about the scope, cause or ultimate impact of the incident beyond what has been officially stated.

Authorities notified

Origin said it had taken steps to notify and engage with the relevant Australian authorities. Specifically, the company said it had notified the Australian Cyber Security Centre and the Australian Federal Police, and that it was engaging with the Office of the Australian Information Commissioner.

Engaging these bodies is consistent with the standard obligations and expectations that apply to large Australian organisations when a potential data or cyber security issue arises. The Office of the Australian Information Commissioner administers the Notifiable Data Breaches scheme, while the Australian Cyber Security Centre provides technical guidance and coordination. Origin's reference to these agencies indicates the company is treating the matter through established regulatory and law-enforcement channels.

Company background

Origin Energy is one of Australia's leading integrated energy companies and a constituent of the country's large-capitalisation share market indices. Its business spans energy retailing, where it supplies electricity and natural gas to a large base of residential and business customers across Australia, and electricity generation. The company is also known for its interest in Australia Pacific LNG, a major liquefied natural gas project, and for its exposure to the technology-focused Octopus Energy Group and its Kraken customer operating platform.

Because Origin serves a substantial customer base, any question concerning the security of customer information is inherently sensitive from both a reputational and operational standpoint. That context helps explain why the company moved to make a formal market disclosure while its investigation was still underway, and why it explicitly addressed the categories of financial data it does not believe were affected.

Potential opportunities and positive factors

From an investor perspective, a few elements of Origin's disclosure may be viewed constructively, though each should be weighed carefully. First, the company stated that it does not believe customer credit card or bank details were affected, which addresses one of the most sensitive categories of personal financial information. Second, Origin acted to disclose the matter to the market and to notify authorities while the investigation was still in progress, an approach consistent with transparency expectations. Third, the company's engagement with the Australian Cyber Security Centre, the Australian Federal Police and the Office of the Australian Information Commissioner indicates it is drawing on established external support.

Beyond the incident, Origin remains a large, diversified energy company with established retailing and generation operations and exposure to significant energy assets. These structural characteristics are unchanged by the disclosure, although investors will naturally want to understand the outcome of the investigation.

Material risks, uncertainties and investor considerations

The most obvious uncertainty is that the investigation is ongoing and, by Origin's own account, at a preliminary stage. The company has not confirmed the number of affected customers, the specific data categories involved, or the cause. Until further updates are provided, the ultimate scope and consequences remain unknown, and investors should be cautious about drawing firm conclusions.

Data and cyber security matters can carry a range of potential consequences for large organisations, which may include remediation costs, regulatory engagement, and reputational considerations. The extent to which any of these apply to Origin cannot be determined from the current disclosure. Readers should also note that the qualified language used by Origin—"potential" incident, data that "may" have been accessed, and the belief that financial details were not impacted—reflects preliminary assessments that could evolve as the investigation continues.

What investors may watch next

The clearest item to monitor is any further ASX announcement from Origin providing updated information on the investigation. Origin has said it will provide further updates as its inquiries progress, and subsequent disclosures may clarify the scope of affected data, the number of customers involved, and any remediation or customer-support measures.

Investors and customers may also watch for communications directed to affected individuals, should the company determine that notification is required, as well as any statements from the Australian authorities Origin has engaged. Beyond the incident, Origin's regular reporting cadence—including operational and financial updates—will remain relevant to the broader investment picture.

Conclusion

Origin Energy's 22 July 2026 disclosure is a preliminary, carefully worded update: the company is urgently investigating a potential security incident that may involve unauthorised access to some customer data, while stating it does not believe credit card or bank details were affected, and it has notified relevant authorities. What remains unconfirmed—scope, cause and ultimate impact—is significant, and Origin itself has committed only to further updates over time.