)
Australia's largest power and gas retailer Origin Energy (ASX: ORG) has conceded today that it failed to initially assess as credible a cyber threat when it first emerged in early July and which ultimately led to the personal information of 900,000 current and former customers being accessed in a cybersecurity breach,
The admission comes after weeks of scrutiny over the company's handling of the incident, with CEO Frank Calabria revealing Origin had been "reviewing a potential security threat" for about three weeks prior to announcing the incident to the public.
"We worked to confirm its credibility and potential impact; however, based on the information available, it was not assessed to be credible," says Calabria.
“On 22 July, new information emerged that indicated a potential security incident may have occurred.
"We acted immediately, providing updates to the market and notifying our customers as a precaution.
“Importantly, this is a criminal matter that is subject to an ongoing investigation by the relevant authorities, and given this, we are constrained by the level of information we can provide about the incident at this time."
Origin today announced that it has completed the initial phase of its review into the customer data security breach.
“At this point in time, we believe the information of approximately 900,000 current and former customers was accessed," says Calabria.
"To our customers, I am sorry. We don’t take for granted the trust customers place in Origin and our safeguarding of their information.
“Supporting affected customers is our key priority. We are contacting those customers whose information has been accessed and are providing support to them."
Origin has extended its customer support hours and established a dedicated contact number for the incident.
“We are working with cyber security and forensic specialists to ensure the incident is contained, and we’ve taken a number of steps to secure our systems," says Calabria.
The breach first came to wider attention when The Australian newspaper reported last week that an individual using the name "Edison Walthour" had claimed to have accessed the data of up to 4.8 million Origin customers.
The alleged hacker, who claimed to be Australian, told The Australian they had used the login credentials of a fired former Origin employee to penetrate customer systems.
Origin has not confirmed or denied that claim.
The Australian subsequently reported that a private settlement had been reached with the hacker following Calabria's public apology on 23 July.
Origin has declined to comment directly on the reported settlement, and no detail has been provided on its nature or terms.
Origin says it is working with the Australian Cyber Security Centre, the Australian Federal Police, the National Office of Cyber Security and the Office of the Australian Information Commissioner in response to the breach.
The incident adds Origin to a growing list of major Australian companies hit by significant data breaches in recent years, including Optus, Medibank and Latitude Financial, all of which faced intense public and regulatory scrutiny over the volume of customer data compromised and the speed of their responses.
“We are acutely aware that others may exploit this incident, including by impersonating Origin or through other scam activity," says Calabria in today's announcement.
“We recommend that all our customers remain vigilant to suspicious activity and a heightened risk of scams."
)
