Origin Says the Breach Is “Potential”. That Word Starts a 30-Day Clock.

Origin Energy said on 22 July that it is “currently investigating a potential security incident which may involve unauthorised access to some customers’ data”. It added that it does not believe the affected data includes credit card or bank details, and that it has notified the Australian Cyber Security Centre and the Australian Federal Police.

Separately, The Australian reported that a hacker sent it a sample of 50 customer records said to contain names, addresses, email addresses, dates of birth, phone numbers and bill history. The ABC noted it could not immediately verify that claim. Origin has more than 4.7 million customers.

So at the time of writing, nothing is confirmed. That is precisely what makes this worth writing about, because the word “potential” is not corporate hedging. It is a legal status, and it starts a clock.

“Potential” is a defined position, not a press line

Under the Notifiable Data Breaches scheme, there are two distinct states, and the difference between them decides what you owe and when.

• You suspect an eligible data breach. You must carry out a reasonable and expeditious assessment of whether it actually is one. Section 26WH(2) of the Privacy Act gives you 30 calendar days maximum, counted from the day you became aware of the grounds that caused the suspicion.
• You have reasonable grounds to believe an eligible data breach has occurred. A separate duty applies: notify the Commissioner and affected individuals as soon as practicable.

Most of the businesses I audit get the second part wrong. They assume the 30 days is a notification deadline, and that they have a month to decide what to tell people. They do not. The 30 days belongs to the assessment. The moment the assessment tips you into belief, the notification clock is “as soon as practicable”, and it does not reset.

Update, 3 September 2026. The exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, released on 31 August and open for consultation until 18 September, would add a second clock rather than replace this one. The 30 day assessment window for a suspected eligible data breach is retained. Proposed on top of it is a statement to the Commissioner within 72 hours of becoming aware of reasonable grounds to believe an eligible data breach has occurred, aligned with the timeframes in the SOCI Act and the Cyber Security Act 2024. It is a draft and may change, but it would make the distinction this article is about considerably more expensive to get wrong, because the moment suspicion becomes belief would start a three day clock. We work through what that means for your procedure in what your data breach response plan has to prove.

Thirty days is a ceiling, not a target

The OAIC is explicit that entities should treat 30 days as a maximum and finish much sooner, because the risk of serious harm to individuals grows with time. If you cannot complete the assessment inside 30 days, the Commissioner expects you to be able to show you took all reasonable steps, which in practice means documenting what you did, when, and why it took longer.

That last point is the one that catches people out. “We were still investigating” is not a defence on its own. Evidence of a structured, prompt investigation is. Those are very different things, and only one of them can be produced after the fact.

The 30 days is also when evidence quietly disappears

The assessment window is the same window in which the evidence you need tends to vanish. Default log retention on a lot of systems is 30 days or less. Cloud audit logs roll over. Someone reimages the laptop to get a staff member working again. A well-meaning administrator resets credentials and destroys the timeline that would have shown what was accessed.

If you cannot answer what was accessed, you generally cannot rule out serious harm, and if you cannot rule out serious harm you are notifying. Poor logging does not just slow the assessment down. It changes the outcome.

“No credit card or bank details” is thinner comfort than it sounds

Origin initially said financial data was not believed to be involved. On 23 July it revised that: the exposed data may include the last four digits of a credit card, or the last three digits of a bank account. Origin is right that those partial numbers cannot, on their own, be used to make a purchase or access an account. But financial fraud was only ever one of the harms in play, and it is not reassurance about identity theft.

If the reported record structure is accurate, the combination in play is name, address, email, date of birth, phone number and billing history. You can cancel a card in ten minutes. You cannot cancel a date of birth, and you cannot reissue an address history. That combination is exactly what is used to pass identity checks, open accounts and run convincing targeted scams, and billing history makes the scam call sound legitimate because the caller knows what you actually pay.

When you run the serious-harm test under the NDB scheme, “no financial data” is one input, not the answer.

Three regimes, three very different clocks

Origin notified the ACSC, the AFP and the Office of the Australian Information Commissioner, and it is worth being precise about why engaging regulators is not the same obligation as telling customers.

Australia runs separate reporting regimes that businesses routinely conflate:

The energy sector sits inside the SOCI regime, but the critical asset definitions key off things like generation capacity and transmission or distribution networks, not customer databases. A retail billing system holding customer contact details is a Privacy Act problem far more obviously than it is a SOCI one. Notifying the ACSC early is good practice regardless, and it is what the ACSC asks for, but it should not be read as evidence that a 12-hour statutory clock was running.

Listed entities carry a third clock, and Origin’s disclosure to the ASX at 12.42pm on 22 July is an example of it. Continuous disclosure is triggered by market sensitivity, not by personal information, and it can require you to speak while the forensic picture is still forming. That is a different judgement from the one the NDB scheme asks for, made by different people, on a shorter fuse.

The practical lesson for everyone else: work out in advance which regimes apply to you, and to which systems. Deciding that at 9pm on the day something happens is how deadlines get missed.

Telling regulators first is correct, and it looks wrong

There is an uncomfortable middle period where you know enough to alert authorities but not enough to tell customers anything useful. Origin passed through it in a matter of hours: regulators engaged during the day, then a direct email to every customer late the same evening confirming an investigation is under way and very little else.

That sequencing is defensible. Notifying individuals before you know what was taken produces panic and, worse, a second announcement correcting the first. But the tolerance for silence is short, and it is shortening. Only last week a healthcare operator was publicly criticised over the delay in disclosing a breach affecting medical records.

The way through is not to choose between speed and accuracy. It is to have decided, before anything happens, who is told what at each stage, who signs it off, and what the holding statement says. Written in advance, that takes an afternoon. Written on the day, it takes a fortnight you do not have.

Update: Origin has now emailed every customer

Origin’s day ran in a specific order. It lodged its statement with the ASX at 12.42pm on 22 July, then emailed customers late that evening. I received one, so what follows is the notification as it actually landed rather than a description of it. It confirms the incident is still only “potential”, repeats that credit card and bank details are not believed to be involved, adds the Office of the Australian Information Commissioner to the bodies engaged, and is signed by a named executive, Jonathan Briskin, Executive General Manager of Origin Retail.

The market was told roughly ten hours before customers were. That ordering looks backwards, and it is not a discourtesy. Continuous disclosure requires immediate notice to the ASX, while the Privacy Act requires notice to individuals only once you have reasonable grounds to believe an eligible breach has occurred. If you are listed, expect to tell investors first, and expect to be asked why.

Two things about the customer email are worth studying, because this is the document most businesses have never drafted.

It is not a Notifiable Data Breach notification, and the difference matters

Under the NDB scheme you notify individuals once you have reasonable grounds to believe an eligible data breach has occurred. Origin has not said that. It is still inside the assessment window described above. What it has issued is a voluntary precautionary communication, and issuing one neither concedes the legal position nor starts the notification clock.

That option is available to every business and almost none prepare for it. It is exactly the holding statement described in the previous section, and it does the job: a named senior executive rather than “the team”, a plain statement of what is not believed to be affected, the regulators engaged, and a commitment to further updates with one place to find them.

What it cannot do is give the customer anything to act on. There is no guidance on what to watch for, because Origin does not yet know. That is the real cost of speaking early, and it is still the right call.

“All customers” is a scoping problem showing through

The detail worth noticing is that Origin is contacting all customers “as a precaution”. That is not generosity. It is what you have to do when you cannot yet establish whose records were touched.

This is the logging problem from earlier in this article, priced. If you can scope a breach precisely, you notify the affected population. If you cannot, your notification population is everyone whose data you hold, and you absorb the support load, the churn and the reputational damage across the entire customer base rather than a subset of it. Origin supplies around 4.8 million accounts, so that difference is enormous.

When people ask what the return on log retention and access monitoring looks like, this is it. It is not the ability to write a better incident report. It is the ability to send a smaller email.

One practical note if you received it

Breach notifications are among the most effective phishing lures there are, because recipients are expecting one and are anxious enough to click without looking closely. If you are an Origin customer, do not use the link in the email. Go to the company’s website directly, or call the number printed on a bill you already had. That advice holds for every breach notification you will ever receive, including the legitimate ones.

What ISO 27001 asks you to have ready

This is the part where a management system stops being paperwork. ISO 27001 puts a small group of Annex A controls exactly over this window:

• A.5.24 Incident management planning and preparation. Roles, decision rights and escalation agreed before the event.
• A.5.25 Assessment and decision on information security events. The documented step that turns “something looks odd” into a classified incident, which is the same step the NDB scheme calls an assessment.
• A.5.26 Response to information security incidents. Containment and the response itself, run to a plan.
• A.5.27 Learning from information security incidents. Feeding the outcome back into controls.
• A.5.28 Collection of evidence. Identifying, collecting and preserving evidence, which is what makes the assessment possible at all.

Read those in order and you have described the 30-day assessment before the Privacy Act ever comes up. That is the useful thing about a certified system: the obligation and the control set are the same work, done once.

Five questions worth answering this week

1. If a customer database were accessed today, could you establish what was accessed, not just that something was? How long do your logs actually retain?
2. Who decides that a suspicion exists, and is the date recorded? The 30 days runs from awareness of the grounds, so if nobody wrote down when that was, you cannot prove the clock.
3. Do you know which regimes apply to which of your systems, before you need to? If you are listed, does your plan sequence the ASX, the regulators and your customers?
4. Is there a holding statement drafted and approved, ready to be filled in?
5. Could you show an auditor, or the Commissioner, evidence that your assessment was prompt and structured?

If any of those makes you wince, that is the work, and it is far cheaper to do now than during an incident.

Where this lands

Origin may yet confirm that little was taken. That would be a good outcome and it would not change the lesson, because the obligations we have described attach to the suspicion, not the confirmation. Every business holding customer data is one alert away from being in the same 30 days, and the difference between an orderly assessment and a scramble is decided long before the alert arrives.

Updated 24 July 2026. Origin first described the incident as “potential” on 22 July (an ASX filing at 12.42pm and a customer email that evening, which the author received). On 23 July Origin confirmed unauthorised access and disclosure of some customers’ data, with CEO Frank Calabria apologising and the exposed data now said to possibly include partial credit card or bank account digits alongside name, address, date of birth, phone number and account details. Origin is still establishing how many customers are affected and continues to work with the ACSC, the AFP and the OAIC. No threat actor had publicly claimed responsibility at the time of this update. We will update again as the position becomes clearer.

Speak with an experienced ISO auditor

If you could not comfortably answer those five questions, we can help you close the gap: building an ISO 27001 information security management system, running an independent internal audit of the incident-response controls you already have, or mentoring your team to build it themselves. Email hello@streamline.business or call us:

• Brisbane 07 3667 8280
• Sydney 02 8315 7780
• Melbourne 03 9034 3990