Key Takeaways

  • Origin Energy (ASX: ORG) chief executive Frank Calabria confirmed on 28 July 2026 that about 900,000 current and former customers were affected, roughly a fifth of the retailer's customer accounts.
  • Exposed data includes names, addresses, dates of birth, contact numbers, account details and partial payment card or bank account numbers. Origin says the partial financial data cannot be used to make purchases.
  • Medibank's breach costs exceeded $125 million by FY25, while the first civil penalty imposed under Australia's amended Privacy Act was $5.8 million - a useful reminder that remediation, not fines, usually dominates the cost.

Why Origin Energy is in focus

Origin Energy (ASX: ORG) is Australia's largest electricity and gas retailer, with roughly 4.7 million customer accounts across electricity, gas, LPG and broadband. It also holds a 27.5 per cent interest in Australia Pacific LNG and a 22.7 per cent economic interest in United Kingdom-based Octopus Energy and its Kraken software platform.

On 22 July 2026 the company told the ASX it was investigating a potential security incident. The following day it confirmed unauthorised access had occurred and customer data had been taken. On 28 July, chief executive Frank Calabria put a number on it: approximately 900,000 current and former customers.

.6 per cent on 28 July. The stock was already near its, having dropped sharply in early July amid a public dispute with the Queensland government over retail pricing - a distinction worth preserving when attributing.

What Origin has disclosed

The 23 July ASX release set out the categories of compromised information: names, addresses, dates of birth, contact phone numbers, account details and partial payment data comprising the last four digits of credit cards or the last three digits of bank account numbers. Origin stated that incomplete card or bank account information cannot be used to make purchases or access accounts.

Origin has engaged independent cyber experts, established a dedicated customer support line and is working with the Australian Cyber Security Centre, the Australian Federal Police and the Office of the Australian Information Commissioner. Calabria's public statement was an apology rather than a technical explanation: "I'm sorry this has happened. Customers trust Origin with their information and I apologise for the impact this may cause."

Putting 900,000 in context

Against a base of roughly 4.7 million accounts, 900,000 affected customers represents about 19 per cent of the book. That is materially narrower than the figures circulating in the first days of coverage, when reports referenced up to 4.8 million records.

What Australian precedent suggests about cost

Australia now has real data points rather than hypotheticals. Medibank Private, breached in 2022 with about 9.7 million people affected, disclosed breach-related costs exceeding $125 million by the end of FY25, covering security uplift, legal fees and administration and carried a separate $250 million capital provision required by APRA. The OAIC commenced Federal Court civil penalty proceedings against Medibank in June 2024 and those proceedings remain on foot.

The most instructive precedent is the smallest. In October 2025 the Federal Court ordered Australian Clinical Labs to pay $5.8 million over the Medlab Pathology breach affecting more than 223,000 people - the first civil penalty ever imposed under the Privacy Act. The award was split between failing to protect data, inadequately assessing the breach and failing to notify the regulator.

The statutory ceiling is far higher. Since the December 2022 amendments, the maximum penalty for a serious or repeated interference with privacy is the greatest of $50 million, three times any benefit obtained, or 30 per cent of adjusted turnover. Headline figures derived from multiplying a per-contravention cap by the number of affected individuals are arithmetic exercises, not realistic outcomes.

The underlying business

Origin's fundamentals are unrelated to the breach and remain the larger driver of value. For the half to 31 December 2025, group underlying EBITDA was $1,589 million, down from $1,926 million and underlying net profit after tax was $593 million, down from $924 million. Adjusted free cash flow rose to $705 million from $518 million.

For FY26, Origin guided Energy Markets underlying EBITDA of $1,550 million to $1,750 million, APLNG production of 645 to 680 petajoules and cash distributions from APLNG of $700 million to $950 million. Group capital expenditure guidance was $900 million to $1,100 million.

The Octopus Energy stake is the swing factor in the equity story. A standalone Kraken equity raise in December 2025 valued that business at US$8.65 billion, with Origin committing US$140 million. The Octopus segment recorded an underlying EBITDA loss of $89 million in the December half, with FY26 guidance of zero to $150 million.

Balance sheet and capital position

Origin declared an interim dividend of 30 cents per share fully franked for the December 2025 half, matching the prior year, under a policy of distributing at least 50 per cent of adjusted free cash flow. Net debt to EBITDA sat at roughly 2.0 times at 31 December 2025, up modestly from 1.9 times at 30 June 2025. No buyback was disclosed.

Moody's described the incident as credit negative, citing reputational harm, regulatory scrutiny, litigation risk and remediation costs, while stating it had no impact on Origin's rating at this time.

Principal risks

The cyber-specific risks are regulatory investigation and potential civil penalty proceedings, class action exposure given the Medibank and Optus template, remediation and notification costs and customer churn in a market where switching is easy and trust is the differentiator retailers spend most to build.

Broader risks are more consequential to earnings. Retail margin regulation through the Default Market Offer constrains pricing and wholesale price volatility drives Energy Markets earnings. The extension of the Eraring coal-fired power station to 30 April 2029 delays a transition milestone while preserving supply. The Octopus and Kraken holding is a private-market valuation subject to revision.

A balanced outlook

The breach is a genuine failure of a duty Origin owes its customers and the company's acknowledgement that it dismissed an early warning as not credible will attract scrutiny from the OAIC. The direct financial consequence, judged against every Australian precedent available, is most likely a manageable multi-year remediation expense with a longer-dated regulatory tail.

The greater risk is reputational, in a market where a customer can switch retailers in minutes. Origin's FY26 results, expected in August, will be the first chance to see whether the incident has touched customer numbers - and whether management can quantify a cost it has so far declined to estimate.