Latest / Tech Talks With Kinsoft / Origin Energy – A 3:40am Email, an Extortionist Called "John Doe", and Millions of Customers in Limbo

Transcript

Origin Energy – A 3:40am Email, an Extortionist Called "John Doe", and Millions of Customers in Limbo · Tech Talks With Kinsoft

• 0:00
  Imagine waking up, like right in the middle of
• 0:02
  the night. It's 3 .40 a .m. Never a good time
• 0:05
  to be checking your phone. Right. I mean, your
• 0:07
  phone screen is just glowing on the nightstand.
• 0:09
  It's vibrating with this high -priority notification.
• 0:12
  Yeah, panic sets in immediately. Exactly. You
• 0:15
  squint at the screen and it's an automated email.
• 0:20
  And it's telling you that your personal data
• 0:22
  has just been compromised. In a massive breach.
• 0:24
  In a massive breach. And here is the kicker.
• 0:27
  That panic inducing middle of the night alert.
• 0:30
  It wasn't sent by some malicious hacker trying
• 0:32
  to mess with you. No, not at all. It was sent
• 0:34
  by the multi -billion dollar company that was
• 0:36
  actually supposed to protect your data in the
• 0:38
  first place. Which is wild because the irony
• 0:42
  is the company actually thought they were doing
• 0:44
  everything exactly by the book. They really did.
• 0:47
  Yeah. And that disconnect like between. The corporate
• 0:51
  playbook and the actual human reality, that's
• 0:54
  exactly what we're dissecting today. Yeah, there
• 0:57
  is a lot to unpack. There really is. So our mission
• 1:00
  on this deep dive is to look at a massive real
• 1:02
  -world cyber breach. We're talking about Australia's
• 1:05
  largest energy retailer, Origin Energy. This
• 1:08
  happened back in July of 2026. And we have some
• 1:11
  incredible source material for this. Yes, we
• 1:13
  are pulling all our insights today from a really
• 1:15
  detailed industry update. It was published by
• 1:17
  Tech Talks with Kinsoft and it's dated July 29,
• 1:21
  2026. It's a great report. Very thorough. It
• 1:24
  is. We're going to extract all those vital, you
• 1:27
  know, sort of counterintuitive lessons hidden
• 1:29
  inside this corporate crisis. And for you, the
• 1:32
  listener, I mean. Even if you don't live in Australia,
• 1:34
  this matters. Oh, absolutely. Because whether
• 1:37
  you are managing risk for a massive enterprise
• 1:39
  or you're just, you know, an everyday person
• 1:41
  relying on companies to safeguard your digital
• 1:44
  life, the mechanics of this breach are going
• 1:46
  to totally change how you look at corporate security.
• 1:48
  It really exposes just how vulnerable our critical
• 1:51
  infrastructure is right now. Yeah. And how modern
• 1:54
  scammers are basically operating in the shadows
• 1:57
  of corporate PR. So, OK, let's unpack this. Well,
• 2:02
  to start, the scale of the target dictates like
• 2:05
  everything about how an incident like this unfolds.
• 2:08
  Right. Origin Energy is not some small regional
• 2:10
  player. I mean, they serve approximately 4 .8
• 2:13
  million customer accounts. That is massive. Yeah.
• 2:16
  And that's across electricity, gas, broadband.
• 2:20
  They pull in an annual revenue of around $8 .5
• 2:23
  billion. Wow. So by every definition, they are
• 2:27
  the backbone of Australian critical infrastructure.
• 2:29
  And when a company of that magnitude alerts the
• 2:32
  market to, you know, unauthorized data access,
• 2:35
  the blast radius is just staggering. I mean,
• 2:38
  statistically, in a country the size of Australia,
• 2:41
  virtually every office building has dozens of
• 2:44
  origin customers sitting right inside. Exactly.
• 2:46
  You can't avoid it. Which I think. Makes the
• 2:48
  timeline of their response so revealing because
• 2:51
  according to the Kinsoft report, Origin didn't
• 2:53
  actually find out about this from like a dark
• 2:55
  web leak. Right. Or some cybersecurity firm stumbling
• 2:57
  across their databases. Exactly. The incident
• 3:00
  broke internally around Wednesday, July 22nd.
• 3:03
  And Origin immediately moved to inform the Australian
• 3:06
  Securities Exchange, the ASX. Which they have
• 3:08
  to do. Right. And they began drafting those initial
• 3:11
  emails to customers. Now, at that really early
• 3:15
  stage, they framed it as an investigation into,
• 3:18
  quote, possible unauthorized access. Yeah, they
• 3:21
  were careful with the wording. Very careful.
• 3:23
  They stated they believe credit card and bank
• 3:26
  details were not impacted. Which, you know, that
• 3:29
  initial phase is pretty standard crisis management.
• 3:32
  Is it? Oh, yeah. You lock down the perimeter
• 3:34
  and you try to prevent a market panic while your
• 3:37
  forensic teams do their scoping. You don't want
• 3:40
  to say too much, too same. But then Thursday
• 3:42
  afternoon rolls around. Right. And the forensic
• 3:44
  reality basically overtakes the PR strategy.
• 3:47
  Yeah. The situation firmed up. Origin had to
• 3:50
  issue a second ASX statement confirming unauthorized
• 3:53
  access to and disclosure of customer data. And
• 3:57
  this came with a public apology, right? It did.
• 3:59
  A public apology from their chief executive,
• 4:01
  Frank Calabria. Now, looking at the macro level,
• 4:04
  Origin actually did a lot right. I mean, they
• 4:06
  followed the modern crisis response framework
• 4:09
  to the letter. Yeah, they really did. They were
• 4:11
  completely transparent with the ASX. They brought
• 4:13
  in independent cyber experts. They looped in
• 4:15
  the Australian Federal Police, the ACSC, the
• 4:19
  Australian Cyber Security Center. And the Office
• 4:21
  of the Australian Information Commissioner, the
• 4:23
  OAIC. Right, all the acronyms. They brought them
• 4:26
  all in. And they even spun up a dedicated support
• 4:29
  line and a web portal for the affected customer.
• 4:31
  And because they moved with that kind of velocity,
• 4:34
  the financial markets actually rewarded them.
• 4:37
  Yeah. The share price only took a relatively
• 4:39
  modest hit. Which makes sense. I mean, the regulatory
• 4:41
  doctrine for publicly traded companies facing
• 4:44
  a breach these days is basically fast, honest,
• 4:47
  and specific. Right. The days of an organization
• 4:50
  sitting on an intrusion for six months just hoping
• 4:53
  it never leaks out, those days are largely over.
• 4:56
  Because the penalties are just way too severe
• 4:57
  now. Exactly. And Origin beat the disclosure
• 5:00
  clock. They went to the market within a day of
• 5:03
  the story breaking and they confirmed the material
• 5:05
  impact within 48 hours. So from a pure governance
• 5:10
  perspective, they executed the playbook perfectly.
• 5:13
  They checked all the boxes. But, and this is
• 5:16
  a huge but, they managed to completely sabotage
• 5:19
  their own goodwill with one bizarre operational
• 5:23
  decision. The emails. The emails. Those automated
• 5:26
  breach notification emails, the ones meant to
• 5:29
  keep customers informed, started landing in people's
• 5:32
  inboxes at 3 .40 a .m. Yeah, it's just such an
• 5:35
  unforced error. I keep thinking about this like
• 5:38
  a building manager, right? A manager who is legally
• 5:41
  required to test the fire alarm system. Okay.
• 5:44
  And they decide, hey, let's run the test at 3
• 5:46
  a .m. just to get it over with. Oh, wow. Right.
• 5:50
  They can point to their clipboard the next day
• 5:52
  and tell the fire marshal, look, we checked the
• 5:54
  compliance box. But they're entirely ignoring
• 5:56
  the fact that they just caused a stampede of
• 5:58
  terrified residents in the middle of the night.
• 6:00
  That is a great analogy. It really is. It screams
• 6:03
  that. the company is managing its own legal liability,
• 6:07
  but they're not managing the actual human beings
• 6:09
  they serve. Exactly. And, you know, the mechanics
• 6:12
  behind a blunder like that usually stem from
• 6:14
  a complete silo between the IT department and
• 6:17
  the customer experience team. Well, when you
• 6:19
  have a database of 4 .8 million people, you can't
• 6:22
  just hit send on an email blast from a regular
• 6:25
  server. Right, it would crash everything. Exactly.
• 6:28
  You have to use bulk customer relationship management
• 6:30
  tools, and IT teams often batch... those sends
• 6:34
  during off -peak hours to avoid crashing their
• 6:36
  own network architecture. Ah, so they were just
• 6:39
  thinking about the servers. Yeah. The IT team
• 6:42
  likely got the green light from the board late
• 6:44
  Wednesday night, loaded the queue, and just hit
• 6:48
  execute. Wow. They were thinking about system
• 6:50
  bandwidth. They were thinking about compliance
• 6:52
  deadlines. They were definitely not thinking
• 6:54
  about the physical reality of push notifications
• 6:56
  vibrating on nightstands across the whole country.
• 6:59
  It perfectly illustrates how macro -level strategy
• 7:02
  can just Completely blind a company to micro
• 7:05
  -level execution. I mean, the Kidsoft report
• 7:07
  makes it really clear that send windows for automated
• 7:10
  emails are a critical, often overlooked part
• 7:14
  of incident response. They really are. Because
• 7:16
  a breach notification sent in the middle of the
• 7:18
  night inadvertently communicates to the customer
• 7:20
  that the company is panicking. It feels like
• 7:22
  an emergency. Right. It undermines the very trust
• 7:26
  the email was drafted to preserve in the first
• 7:28
  place. And that failure to consider the psychological
• 7:31
  impact on the end user, it doesn't just start
• 7:34
  at the timing of the email. It actually bleeds
• 7:36
  directly into how companies evaluate the stolen
• 7:40
  data itself. Let's pivot to that data payload
• 7:42
  because the corporate messaging around what was
• 7:45
  actually taken is where things get genuinely
• 7:48
  dangerous. Yeah, it really does. So Origin confirmed
• 7:51
  the compromised data included fullness. names,
• 7:53
  physical addresses, dates of birth, phone numbers,
• 7:56
  and account information. Which is awful. It's
• 7:58
  terrible. We already know that it's a complete
• 8:00
  starter kit for identity theft. But it was their
• 8:03
  statement regarding the financial data that felt
• 8:05
  incredibly misleading. Right. So Origin disclosed
• 8:08
  that partial financial details were accessed.
• 8:11
  Specifically, they said the last four digits
• 8:13
  of credit cards and the last three digits of
• 8:16
  bank accounts. And the company immediately went
• 8:18
  on the defensive about this. They stressed in
• 8:20
  their communications that these fragments are
• 8:22
  incomplete and they cannot be used to fraudulently
• 8:25
  charge anyone's account. Technically, that's
• 8:27
  true. Technically, yes. I mean, you cannot walk
• 8:29
  into a store and buy a laptop with only the last
• 8:31
  four digits of a credit card. But offering that
• 8:34
  as a reassurance? I feel like that creates a
• 8:37
  massive blind spot for the consumer. It absolutely
• 8:40
  does. When a giant corporation tells its customers,
• 8:42
  hey, your money is safe because the data is partial,
• 8:45
  they are basically lulling people into a false
• 8:48
  sense of security right at the exact moment.
• 8:51
  Those people need to be hypervigilant. What's
• 8:53
  fascinating here is that the Kinsoft report flags
• 8:56
  this specific corporate blind spot. You see,
• 8:59
  organizations often treat data encryption as
• 9:02
  a binary win. Like either they got it or they
• 9:05
  didn't. Exactly. They assume because the full
• 9:08
  pan, the primary account number is hashed or
• 9:10
  hidden, then the financial risk is basically
• 9:13
  zero. That's not how it works anymore. Not at
• 9:15
  all. Modern threat actors do not operate that
• 9:17
  way. They don't need to drain the Origin Energy
• 9:19
  account directly. They use those partial digits
• 9:22
  as an access token to bypass identity verification
• 9:25
  at other institutions. Yes, because think about
• 9:29
  it. Almost every call center in the world uses
• 9:32
  the last four digits of a card as a security
• 9:34
  question. Pretty much all of them. So if an attacker
• 9:37
  calls my mobile phone provider to execute, like
• 9:39
  a SIM swap, the telecom rep is going to ask,
• 9:43
  can you verify the last four digits of the card
• 9:45
  you pay your bill with? And the attacker has
• 9:47
  them. The attacker has my name, my address, my
• 9:50
  date of birth, and now those magic four numbers.
• 9:54
  So they just... hijack my phone number, which
• 9:56
  means they now intercept all my two factor authentication
• 9:59
  texts. It's terrifyingly easy. The value of partial
• 10:03
  data in the modern threat landscape is entirely
• 10:06
  based on cross -platform authentication and high
• 10:09
  -tier social engineering. Meaning what exactly?
• 10:12
  Meaning the attacker will spoof Origin's phone
• 10:14
  number, call the customer directly, this is called
• 10:17
  vishing or voice phishing, and read those four
• 10:20
  digits back to them. Oh, wow. Yeah. The psychological
• 10:23
  effect of hearing a stranger recite your credit
• 10:26
  card digits on the phone is profound. It instantly
• 10:28
  bypasses the victim's critical thinking filter.
• 10:31
  Because you... just assume they must be real
• 10:33
  if they know those numbers. Yeah, exactly. The
• 10:35
  customer assumes the caller is legitimate, which
• 10:38
  allows the attacker to pivot and ask for the
• 10:40
  full card number or a password or a texted security
• 10:43
  code. So. Origin's failure to explicitly warn
• 10:47
  their customers about that specific tactic, that
• 10:50
  is a huge operational miss. It's massive. Organizations
• 10:53
  can't just, you know, pat themselves on the back
• 10:55
  for encrypting the full card numbers. The moment
• 10:57
  a breach like this is confirmed, the customer
• 11:00
  facing teams need to be briefed on the impersonation
• 11:02
  risk immediately. Absolutely. And the public
• 11:05
  needs to be told specifically how scammers will
• 11:08
  weaponize those exact fragments of data. The
• 11:11
  overarching lesson from the Kinsoft analysis
• 11:13
  is clear. If you hold utility -scale databases,
• 11:16
  you must assume that partial data is highly monetizable.
• 11:20
  It's not just harmless debris. No, it is a skeleton
• 11:22
  key for social engineering. Man. And speaking
• 11:25
  of manipulating trust, the attacker in this scenario
• 11:28
  didn't just manipulate the customers. They attempted
• 11:31
  to manipulate the entire national media apparatus.
• 11:34
  Which is arguably the strangest dynamic of this
• 11:36
  entire origin breach. It really is. Yeah. Because
• 11:39
  when a massive enterprise gets hit, I think we
• 11:42
  are all conditioned to expect a highly organized
• 11:45
  ransomware cartel. Right. You expect a group
• 11:48
  with a dark web leak site, a flashy logo, a whole
• 11:52
  team of professional negotiators. But the Kinsoft
• 11:55
  report highlights a radical departure from that
• 11:58
  pattern. The adversary claiming responsibility
• 12:01
  here was not a known ransomware syndicate. Yeah.
• 12:04
  It was a lone wolf individual operating under
• 12:07
  the moniker John Doe. Just John Doe. Yeah. And
• 12:10
  this individual demanded that Origin negotiate
• 12:12
  with them over the encrypted messaging app, Signal.
• 12:15
  Which is so informal. Totally. They claim to
• 12:17
  be holding two million customer records. Now,
• 12:20
  the Kinsoft source carefully notes that this
• 12:22
  two million figure is completely unverified,
• 12:24
  right? Yeah, that's important to mention. It's
• 12:26
  a claim generated by the criminal, not by Origin's
• 12:29
  official scoping work, which was still ongoing
• 12:31
  at that point. Right. They were still figuring
• 12:34
  it out. But John Doe didn't just sit back and
• 12:36
  wait for Origin's IT department to reply on Signal.
• 12:39
  They built a dedicated extortion website threatening
• 12:42
  to dump the data within two weeks. And then.
• 12:45
  They went straight to the press. Yeah, they actively
• 12:48
  emailed journalists. They even contacted the
• 12:50
  tip line for 7 News, one of the major television
• 12:52
  networks in Australia, claiming they had tried
• 12:55
  to warn Origin's security team and the board,
• 12:59
  but that their emails were just ignored. So this
• 13:02
  attacker deliberately ceded the narrative to
• 13:04
  the media to basically force the company's hand.
• 13:07
  Yep. So. What does this all mean? Like, how does
• 13:10
  a board of directors practically respond when
• 13:13
  a journalist from a major network calls them
• 13:14
  asking for comment on a massive data breach that
• 13:17
  the company's own IT department might still be
• 13:20
  trying to verify? It flips the entire crisis
• 13:22
  response timeline upside down. Completely. Is
• 13:25
  there a playbook for like a random guy with a
• 13:27
  hostage or do companies only know how to deal
• 13:29
  with organized cartels? Well, if we connect this
• 13:32
  to the bigger picture of corporate incident response,
• 13:34
  it exposes a really glaring vulnerability in
• 13:38
  how enterprises prepare for extortion. Organizations
• 13:41
  spend millions building playbooks for dealing
• 13:44
  with organized cartels. Incident response firms
• 13:47
  track those syndicates. They use blockchain analysis
• 13:50
  on the cartels previous crypto wallets to see
• 13:53
  if they actually delete data after being paid.
• 13:55
  They know the cartels negotiation tactics, but
• 13:59
  dealing with a loan. wolf on signal that removes
• 14:02
  all of that historical intelligence. It is entirely
• 14:05
  asymmetrical warfare. Exactly. A single anonymous
• 14:08
  person using a free messaging app. can dictate
• 14:11
  the public relations schedule of an $8 .5 billion
• 14:14
  company. It's crazy. And Robert Potter, he's
• 14:17
  a prominent security researcher mentioned in
• 14:19
  the report, he criticized the early media coverage
• 14:21
  precisely because the press initially failed
• 14:23
  to disclose that the narrative was being spoon
• 14:25
  -fed to them by the extortionist. Yeah, the media
• 14:28
  inadvertently became the attacker's leverage.
• 14:31
  Which is just a classic extortion play. Right.
• 14:33
  And this strategy became really prevalent during
• 14:35
  the Medibank data breach era. And it remains
• 14:38
  highly effective because it exploits the media's
• 14:40
  hunger for a scoop. The attacker knows that if
• 14:44
  the victim company refuses to engage privately,
• 14:47
  turning the breach into a national news story
• 14:50
  applies just unbearable public pressure on the
• 14:54
  board of directors. The attacker weaponizes the
• 14:56
  news cycle. So it means a modern breach communications
• 14:58
  plan cannot assume the company will control the
• 15:01
  timing of the disclosure. No, not at all. Your
• 15:04
  first public statement might have to be drafted
• 15:06
  on the fly because some reporter is threatening
• 15:08
  to run a story based on claims from a hacker's
• 15:11
  signal message. And the crisis plan has to cover
• 15:14
  incredibly difficult governance questions. Like
• 15:17
  what? Well, like who inside the organization
• 15:19
  is actually authorized to open a signal chat
• 15:22
  with an extortionist? Oh, true. And how do you
• 15:24
  verify the attacker actually has the data they
• 15:27
  claim to have before you issue a public statement?
• 15:29
  Because there is no dark web leak site countdown
• 15:32
  clock to monitor here. There is no predictability.
• 15:36
  None. The incident response teams are flying
• 15:38
  blind against an adversary who has no brand reputation
• 15:41
  to protect and absolutely no established rules
• 15:44
  of engagement. You are basically fighting a high
• 15:46
  stakes public relations war in real time. Exactly.
• 15:50
  Okay, so synthesizing everything we've pulled
• 15:52
  from this Kinsoft update, I feel like the Origin
• 15:54
  Energy breach redefines what a cyber incident
• 15:57
  actually is. It really does. These events are
• 15:59
  no longer just contained IT problems that you
• 16:01
  solve with, like, server patches. No. They are
• 16:04
  rigorous compliance races where the regulatory
• 16:06
  clock demands speed. But as we saw with those
• 16:10
  3 .40 a .m. emails, raw speed without human empathy
• 16:14
  creates a secondary customer service crisis.
• 16:17
  Completely. They are psychological social engineering
• 16:20
  setups where technically safe partial data is
• 16:23
  weaponized to manipulate trust. And they are
• 16:25
  brutal PR wars, where lone attackers use national
• 16:28
  media outlets as their personal leverage. It
• 16:30
  requires a holistic, multidisciplinary approach
• 16:33
  to crisis management. You have to integrate legal,
• 16:36
  IT, public relations, and customer experience
• 16:38
  from minute one. So for you, the listener, the
• 16:41
  application of all this is incredibly practical.
• 16:43
  Whether you are, you know, an executive sitting
• 16:46
  in a boardroom drafting a crisis plan, or you're
• 16:48
  just a consumer picking up your phone to a caller
• 16:51
  claiming to be your utility provider. Mechanics
• 16:54
  of this psychological manipulation are playing
• 16:56
  out in real time in your daily life. It's everywhere.
• 17:00
  It is. The threat is no longer just brute force
• 17:02
  hacking. It is the exploitation of trust at every
• 17:06
  single level. And, you know, this raises a final
• 17:08
  lingering question about the evolution of these
• 17:10
  threats. Oh. Yeah. It builds on our analysis
• 17:13
  of the lone wolf attacker versus the organized
• 17:16
  cartel. We discussed the chaotic nature of dealing
• 17:19
  with an unaffiliated individual like John Doe
• 17:22
  on Signal. Right. The lack of a playbook. Right.
• 17:25
  Engaging with an established ransomware cartel
• 17:28
  is, oddly enough, a known quantity. They have
• 17:30
  a brand to protect. Exactly. They have a predictable
• 17:33
  playbook and they have a dark web. brand reputation
• 17:36
  they actively maintain. They want future victims
• 17:39
  to believe they will actually honor a ransom
• 17:41
  agreement. So wait, does the absolute anonymity
• 17:45
  and lack of reputation of a lone wolf hacker
• 17:47
  actually make them far more dangerous to negotiate
• 17:51
  with? Think about it. With a cartel, there is
• 17:55
  an established game theory. There are parameters
• 17:58
  and historical data points that incident response
• 18:01
  firms can leverage. But with a lone wolf. With
• 18:03
  a lone wolf, you are stepping into a void. They
• 18:06
  might delete the data, they might leak it anyway,
• 18:08
  or they might just disappear. So the unpredictability
• 18:11
  is the ultimate threat. Yeah. Is there a twisted
• 18:13
  reality where massive corporations backed into
• 18:16
  a corner by a brooch might actually prefer being
• 18:19
  hacked by an organized criminal syndicate rather
• 18:21
  than a random individual with a Signal account?
• 18:24
  Wow. That is a wild thought to leave on. Yeah.
• 18:28
  The adversaries are evolving in ways that our
• 18:30
  traditional corporate playbooks simply haven't
• 18:33
  accounted for. We really have to stop looking
• 18:35
  at the visible locks on the doors and start paying
• 18:37
  attention to the invisible psychological levers
• 18:39
  these attackers are pulling. Thank you so much
• 18:42
  for joining us on this deep dive. Keep questioning
• 18:44
  the digital world around you.