Australia's largest gas and electricity retailer Origin Energy is investigating a potential data breach after an anonymous hacker claimed to have stolen the personal information of more than two million Australians.

Origin first reported the potential cybersecurity incident to the Australian Stock Exchange (ASX) on Wednesday afternoon.

Soon after, reports broke of an anonymous threat actor approaching media outlets to claim responsibility for the incident.

Though Origin said the possible breach may involve unauthorised access to “some customers’ data”, the anonymous hacker claimed more than two million customers had been impacted.

Origin did not specify what types of data may be impacted, though a 50-record leak sample sent to The Australian reportedly included names, addresses, email, dates of birth, phone numbers and billing history.

Other publications were told the hacker’s data also included account numbers, property IDs (presumably referring to an internal database ID value), and internal billing details such as dates of payments, amounts, statuses, and more.

“We do not believe the impacted data includes customer credit card or bank details,” wrote Origin.

Though Origin has not overtly confirmed the incident, executive general manager Jonathan Briskin reportedly provided an update to customers via email on Thursday.

“We are contacting all Origin customers as a precaution while we conduct a thorough investigation into the potential impact of this incident,” Briskin wrote.

“We sincerely apologise for the uncertainty this may cause while we carry out our investigation.”

According to the Australian Competition and Consumer Commission (ACCC), Origin has approximately 4.8 million customer accounts across Australia.

‘John Doe’ trickles information to media

Identifying themselves as ‘John Doe’, the purported threat actor told 7News they’d “successfully accessed Origin Energy’s customer care systems and dumped the private data of over two million Australians who use their services”.

Information Age understands no leaked information for the alleged breach has appeared on the dark web at the time of writing.

Further, no known threat actor or ransomware gang has publicly claimed responsibility for the incident.

John Doe claimed the breach predominantly affected “loyal, long-term customers”.

The anonymous hacker claimed they’d reached out to board members, security teams, and customer care departments at Origin to initiate negotiations, but were largely disregarded.

“Origin hasn’t made a public announcement about the breach or responded to negotiate next steps,” wrote John Doe.

“They’ve shown no interest in resolving it before the data goes public.”

‘Respond, or I’ll leak it all’

The threat actor has reportedly demanded Origin reach out to “settle the matter” within 14 days.

If no agreement is reached, John Doe claimed they would simply publish the data in full.

“If you do not message us and the timer reaches zero, we will leak 2 millions of your loyal customers’ data that we have [sic],” read an alleged message to Origin.

The threat actor has reportedly given Origin Energy a countdown timer for its negotiations. Source: 7News

Alleged communications to Origin used first-person plural pronouns such as “us” and “we”, suggesting John Doe may represent a hacking group or ransomware collective rather than a single individual.

Information Age asked Origin whether it has received a ransom demand or communications from a threat actor but did not receive a reply prior to publication.

When will customers hear from Origin?

In its ASX announcement, Origin said its investigations were proceeding as a matter of urgency, and the company would provide further updates as “appropriate”.

Michael Jackas, director of information and technology at security provider SKG Services, said issuing a “cautious initial statement” was the right call while forensic investigators verify what has occurred.

“Repeating an unconfirmed figure like two million records before that's independently verified would be irresponsible, for Origin or for any organisation in this position,” said Jackas.

He noted, however, that such restraint has a “shelf life”.

“Once the scope is confirmed, customers are owed clear, practical detail [about] what categories of data were involved, whether information was accessed or removed, whether the incident is contained, and what steps affected customers should take.

“An initial 'we're investigating' holding statement is reasonable.

“Weeks of silence after that would not be.”

The alleged Origin incident follows another large-scale data breach last week, when Australian GP network Partnered Health reported a hack impacting up to 21 clinics across Australia.

Similar to Origin, Information Age understands no threat actor or established ransom group has publicly claimed responsibility for the Partnered Health incident.

Craig Costello, professor in the School of Computer Science at Queensland University of Technology, said the incidents demonstrate that Australia continues to be a “high-value target” thanks to the “huge amounts of customer data” organisations hold.

“Even where financial information isn't compromised, personal data can be weaponised for highly targeted phishing, identity fraud, social engineering and extortion,” said Costello.

“For Australian organisations, that means the focus needs to shift to reducing the intelligence value of the data organisations retain.”

Costello added healthcare and critical infrastructure continue to be “prime targets” because they hold some of the most valuable data for cyber attackers.

“This data is deeply personal, making the impact especially serious and infinitely harmful,” he said.

Origin said it had notified the Australian Cyber Security Centre and Australian Federal Police, and engaged with the Office of the Australian Information Commissioner.