Origin Energy hack: Major thing 4.8 million Aussies must do after cyber attack

Households are being urged to remain vigilant following a massive data breach experienced by utilities giant Origin Energy.

In a grim update to the market on Thursday, Origin Energy confirmed the worst-case scenario that a hacker had stolen Australians’ personal data, including credit card and banking information.

This followed a Wednesday announcement that someone may have hacked into the energy giant’s systems.

Reports in The Australian based on correspondence with the alleged hacker suggested that two million customers had their data stolen.

Origin Energy is yet to confirm how many of its 4.8 million customers have been impacted.

For affected customers, impacted data may include a name, address, date of birth, contact phone number and account information, as well as the last four digits of a credit card or the last three digits of a bank account.

Incomplete credit card or bank account information cannot be used to make purchases or access accounts.

McAfee head of APJ Tyler McGee, who was one of the customers Origin reached out to warning of the potential data breach, said scammers would use a high profile breach to their advantage.

“Until there’s more clarity about the breach, it is difficult to understand how exposed consumers who are caught up in this are, but the bottom line is any information that has been extracted helps them build out a future scam to target the individual or sell it to other scammers,” he said.

“It makes it easier for them to come up with different types of scams to address (the victim) very personally and make it feels like it is coming from a reputable business that they may be dealing with.”

Mr McGee said it was a numbers game for scammers, with them only having to catch a handful people to justify buying the data.

According to reports in The Australian on Friday, the alleged hacker who went by the name of Edison Walhour would not proceed with their threat of selling the data online.

The alleged hacker, who said they were an Australian, is believed to be a former Origin employee.

Reports suggest the hacker used their employee login to access Origin’s customer management system supplied by Kraken.

Mr McGee said Australians could protect themselves in a few ways.

“Starting with the basics, impacted customers should check their passwords, and if they can, they should set up two-factor authentication,” he said.

“The next thing is to be suspicious of any kind of emails or text messages that are asking for a customer to click on a link or pay for something.

“The reality is you just have to have a heightened level of awareness for a period of time and I would recommend that if you want to be fully protected, look at products that can provide scam protection.”

According to Mr McGee, the problem for households going forward is that once the information is out there, it does not go away.

He said Australian companies were favoured by hackers due to being soft targets.

“Firstly, there seems to be a higher level of acceptance within corporate businesses to pay ransoms historically, and secondly, the law enforcement in Australia doesn’t pursue these scammers outside Australia,” Mr McGee said.

“That differs from other countries, such as the United States, who will work with other authorities to reach in and threaten deportation to their country to face prosecution.”

Origin chief executive Frank Calabria apologised to customers.

“I’m sorry this has happened. Customers trust Origin with their information, and I apologise for the impact this may cause,” he said.

“We are working with independent cyber experts to support Origin, and that work is continuing alongside the work of authorities.”