One of Australia's biggest energy companies says many of its customers had data accessed in a security breach, warning of the potential for scam activity.
A cyberattack on Origin Energy included unauthorised access and disclosure of customer data on July 22, with names, addresses, dates of birth, phone numbers and account information all potentially viewed in the breach.
Origin chief executive Frank Calabria said the information of about 900,000 current and former customers was accessed in the breach.
The company, which has nearly five million customers, had been reviewing a potential security threat since early July, but deemed it was not credible, Mr Calabria said on Tuesday.
“On July 22, new information emerged that indicated a potential security incident may have occurred ... we acted immediately, providing updates to the market and notifying our customers as a precaution," he said.
“Importantly, this is a criminal matter subject to an ongoing investigation by the relevant authorities, and given this, we are constrained by the level of information we can provide about the incident at this time."
Along with personal identification information, the last four digits of credit cards or the last three digits of bank accounts could also be at risk.
Origin continued its apology for the data breach and said it was working with a number of agencies, including the federal government, the Australian Cyber Security Centre and police, to investigate.
The company urged its customers to be wary of suspicious activity following the breach.
That includes being cautious of unexpected calls and texts related to Origin accounts, and not providing online passwords or financial information to anyone unless being certain of who they are dealing with.
“We are acutely aware others may exploit this incident, including by impersonating Origin or through other scam activity," Mr Calabria said.
Origin has 4.8 million customer accounts in Australia and provides electricity, natural gas, LPG and internet services.
The breach represents the nation's most high-profile cyber incident since Partnered Health, owned by private equity firm Quadrant, said earlier in July that its medical records were breached in clinics in Sydney, Melbourne and Canberra.
