Origin Energy has revealed that data belonging to its customers has been compromised by a recent data security incident, a day after it first confirmed it was the victim of a cyber attack.
“Origin can confirm there has been unauthorised access and disclosure of some customers’ data,” the company said in a statement to the ASX on the afternoon of July 23.
“We are working to understand the total number of impacted customers, and we will contact any customers where we can confirm they have been affected.”
Origin said the data involved “may include” names & addresses, phone numbers, dates of birth, account details, and either the last four digits of a credit card or the last three digits of a bank account.
Origin Energy’s CEO, Frank Calabria, apologised to customers regarding the breach.
“I’m sorry this has happened. Customers trust Origin with their information, and I apologise for the impact this may cause,” Calabria said in the ASX update.
“We are contacting customers, offering support and have set up a dedicated contact number and additional resources to help manage our response to this incident.
“One of our key priorities is taking action to secure our systems and ensure no further unauthorised access. We are working with independent experts to support Origin, and that work is continuing alongside the work of authorities.”
The AFP, the Australian Cyber Security Centre, and the OAIC are assisting Origin.
Cyber Daily understands that customers have received an update regarding the incident; however, some have expressed concern over the timing of the emails, which were sent at approximately 3.40 am on July 22.
As of the time of writing, no threat actor has claimed responsibility for the incident.
Media matters
Origin customers aren’t the only ones asking questions regarding the incident. Several Australian media outlets were contacted by the alleged hacker, which led to the story breaking in the first place, leaving some wondering about the role of journalists in incidents such as this one.
Robert Potter, founding partner of the Cyber Activities Group and CEO of Internet 2.0, said that the reporting on the incident omitted the fact that the initial lead came from a cybercriminal.
“Media engagement is a regular and deliberate part of modern cyber extortion. These are multilayered pressure campaigns by seasoned criminals,” Potter said in a social media post.
“Attackers contact journalists to increase pressure on the victims, establish credibility, accelerate disclosure and turn a private negotiation into a public crisis. This is a deliberate part of the campaign to force companies to make a payment. Journalists are therefore not passive recipients of information; they can become part of the pressure mechanism, even where they are acting entirely in good faith.”
Potter contends that this does not mean that such a lead should be ignored, as it is clearly in the public interest to know such an incident has occurred. Rather, he says, that detail should be a part of any story.
“That disclosure would allow the public to understand the source, motive and circumstances surrounding the information. It would also make clear that the media had been deliberately drawn into an active extortion campaign,” Potter said.
“This is uncomfortable and sensitive territory, but it's also why this transparency should have been in place. When an alleged cybercriminal approaches the media to amplify a threat, the existence of that contact is not incidental. It is part of the story and should sit with readers.”
You can read more industry reactions here.
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
David Hollingworth
David Hollingworth has been writing about technology for over 20 years, and has worked for a range of print and online titles in his career. He is enjoying getting to grips with cyber security, especially when it lets him talk about Lego.