An individual claiming to be the hacker responsible for a recent data breach at Origin Energy has publicly criticized the company's cybersecurity measures, describing them as inadequate and stating that the breach was motivated by the company's decision to offshore jobs. The hacker, identifying as Edison Walthour, asserted that no customer data would be leaked, stating that the matter had been settled privately with Origin Energy.
According to the hacker's claims, Origin Energy's systems exhibited significant security vulnerabilities, including the absence of a company VPN and the use of simple, predictable passwords. "School projects have better security sometimes," the hacker stated.
Walthour further explained that the company's decision to move operations offshore was a primary reason for targeting Origin. "I did this because Origin hires customer care agents offshore to save money," the hacker said, alleging that they had access to customer tools for three weeks without detection by the IT team. "They don't care about customer security at all. They just care about saving money."
Origin Energy confirmed on Thursday that a data breach had occurred, potentially affecting nearly five million customers. The compromised information may include names, addresses, dates of birth, phone numbers, and account details. The company also confirmed that the last four digits of credit card numbers and the last three digits of bank account numbers may have been accessed, a detail it had initially not believed to be part of the breach.
Origin stated that the accessed credit card or bank account information is incomplete and cannot be used for purchases or to access accounts. The company initiated an investigation after being contacted by media outlets that had received a sample of customer records from the alleged hacker. "I'm sorry this has happened. Customers trust Origin with their information, and I apologise for the impact this may cause," said Origin CEO Frank Calabria. "One of our key priorities is taking action to secure our systems and ensure no further unauthorised access."
Origin Energy is Australia's largest energy provider. This incident follows other high-profile cyberattacks in Australia, including breaches affecting Partnered Health, Qantas, Optus, and Medibank in recent years.