Origin: former PM’s cyber security adviser explains why paying ransom bad idea to avoid embarrassment

Big corporations should refrain from paying hackers to avoid embarrassment, a former prime ministerial adviser on cyber security has declared, after an alleged criminal boasted about reaching an unverified deal with Origin.

Alastair MacGibbon, the founding chief of the Australian Cyber Security Centre who was also a special adviser to Malcolm Turnbull, said while he opposed a blanket ban on paying extortion demands, it should be a last resort unless lives, the functioning of an organisation or Australia’s economy were at risk.

“Any payments will obviously encourage further criminality and that’s not an unviable argument of course because it’s obviously fuelling a criminal economy,” he told The Nightly.

“Embarrassment of the company, who obviously had the breach, and non-critical type stuff is not really the threshold and usually you would reserve contemplation for paying only if systems were locked up versus data stolen.

“I don’t think we can be too black and white about it, but we should certainly discourage paying the criminals in any circumstance.”

Mr MacGibbon made some broad comments on the principle of paying hackers after an alleged hacker using the alias of Edison Walthour told The Australian a settlement had been reached with Origin, after the names, addresses, birth dates, phone numbers were stolen, along with partial credit card, banking account details and billing arrangements of two million customers.

“We took our site down, we already settled everything with Origin energy privately and no data will be leaked,” the individual told News Corp.

Origin, which has more than 4.7m customers with electricity, gas and internet accounts, has yet to publicly confirm exactly how many customers had their data stolen, when the breach occurred and whether a hacker had been paid.

“Origin notes there is considerable media speculation in relation to the data security incident we are actively managing,” a spokesman said on Friday.

“Our investigation is ongoing, and we currently have no further updates.”

Origin chief executive Frank Calabria on Thursday issued an apology to customers.

“’I’m sorry this has happened. Customers trust Origin with their information, and I apologise for the impact this may cause,” he said.

“We are contacting affected customers, offering support and have set up a dedicated contact number and additional resources to help manage our response to this incident.”

Origin on Wednesday told the Australian Securities Exchange no credit card or banking details were stolen, which the story in The Australian disputes.

“Origin Energy Limited is currently investigating a potential security incident which may involve unauthorised access to some customers’ data,” it said.

“We do not believe the impacted data includes customer credit card or bank details.”

While AI is getting more sophisticated, Mr MacGibbon said humans were still likely to comprise the majority of hackers in the near future, despite OpenAI’s autonomous experimental model last week breaking free from an isolated testing lab and hacking into New York technology company Hugging Face.

“I think AI-assisted hacking will grow and at some point it will become one of the major channels,” he said.

“AI’s developing really fast and the hacking ability of these large-language models is jaw-dropping and getting better by the month so I would argue that it will become a major wedge in a pie chart.”

Medibank in November 2022 refused to pay a random after the records of 9.7m customers were hacked.