A hacker who claims to have breached Origin Energy's systems says they have reached a private agreement with the company and will not leak the stolen customer data.

The claim came as Origin confirmed unauthorised access exposed customers' personal details and limited payment information.

On Wednesday, Australia's largest gas and electricity retailer Origin Energy told the Australian Stock Exchange (ASX) it was investigating a potential data breach after a hacker claimed to have cracked into its customer care systems.

The company has since confirmed “unauthorised access” took place in an undisclosed part of its ecosystem, and that “some customers’ data” was exposed in the process.

Origin – which has approximately 4.8 million customer accounts across Australia – confirmed the data may include names, addresses, dates of birth, contact phone numbers, and certain “account information”.

Other impacted details included the last four digits of credit cards and the last three digits of bank accounts, though the energy retailer emphasised these “incomplete” details are not enough to make purchases or access accounts.

The company previously said it did “not believe” the impacted data included customer credit card or bank details whatsoever.

“I’m sorry this has happened,” said Origin chief executive Frank Calabria.

“Customers trust Origin with their information, and I apologise for the impact this may cause.”

An anonymous hacker initially claimed to have stolen data for more than two million Australians, but Origin’s latest update only confirmed it was working to determine the total number of impacted customers.

“We are contacting affected customers, offering support and have set up a dedicated contact number and additional resources to help manage our response to this incident,” Calabria said Thursday.

Information Age asked when customers can expect to hear more about the scope and cause of the incident but was directed to Origin’s existing statements.

“Our investigation is ongoing, and we currently have no further updates,” a spokesperson said.

Hacker says Origin made a deal

A person claiming to be the Origin hacker reportedly said it had reached a deal with the energy retailer and would no longer sell or publish the data online.

Though the hacker said they initially gave Origin a countdown timer to push the company into negotiations, they have reportedly taken their ransom countdown site offline following a round of private discussions.

“We already settled everything with Origin energy privately and no data will be leaked,” they told The Australian.

Origin did not confirm or deny the alleged negotiations to Information Age, though Calabria has maintained the company’s “key priorities” are to secure its systems and prevent further unauthorised access from reoccurring.

“We are working with independent cyber experts to support Origin, and that work is continuing alongside the work of authorities,” said Calabria.

Although Origin has not commented on the hacker’s specific claims, the company was unimpressed by the ongoing coverage of its data breach.

“Origin notes there is considerable media speculation in relation to the data security incident we are actively managing,” a spokesperson told Information Age.

Worker allegedly fired after logins used for breach

The purported hacker – who has claimed to be an Australian – said Origin had wrongfully accused and sacked an employee whose credentials were illegitimately used during the data breach.

The self-proclaimed hacker said they wanted to demonstrate security risks introduced by Origin’s recent offshoring initiatives, leading them to target a poorly protected customer management system supplied by technology provider Kraken.

“I had access to their customer tools for three weeks, and their IT team didn’t detect anything before I managed to dump the data of two million users,” they reportedly said.

In October 2025, Origin confirmed a separate, smaller data breach which was allegedly performed by a terminated employee.

The company also appeared in a list of third-party victims tied to an alleged data breach at cloud company Oracle in March 2025.

Don't trust a criminal

Nalin Arachchilage, associate professor in cybersecurity at RMIT University, said once data has left an organisation’s systems, the company “loses all control” over what happens to it next.

"A criminal's promise not to release stolen data isn't a guarantee – it's a negotiating position,” Arachchilage told Information Age.

“Even if this particular actor doesn't publish the data, we have no way of verifying whether copies have already been sold, shared, or passed on to other criminal groups.”

Despite the alleged hacker has promised not to leak the data, Arachchilage said affected Origin customers should still expect some “delayed risk”.

“The core problem is that stolen data doesn't expire the way a cancelled credit card does,” he said.

“Names, dates of birth and account details stay useful to criminals for years.

“And even without full card or bank numbers, this is a rich enough combination to build a very convincing impersonation scam.”

Origin has published a dedicated scam safety page to help customers determine whether future messages are legitimately from the energy giant.

“Whenever a company is in the news for any kind of data or security issue, scammers move fast,” wrote Origin.

“To keep yourself and your data safe, we recommend treating unexpected messages with caution, and check anything that asks you to click, pay, or hand over personal details before you act on it.”