The Origin Energy Breach Is a Reminder: Your Power Bill Is a Digital Asset Too
Australia's largest energy retailer just confirmed something uncomfortable: hackers had unauthorised access to Origin Energy customer data, including names, addresses, dates of birth, phone numbers, account information, and the last four digits of some customers' bank account and card details. Origin has confirmed about 900,000 current and former customers are affected. Given Origin services well over four million accounts across electricity, gas, and broadband, the number is likely to be large.
Most of the coverage this week has focused on the obvious angle: another Australian company, another breach, another round of "check if you're affected." That's worth doing. But there's a second story hiding inside this one, and it's the one nobody's telling.
Nobody catalogues their power bill
When people think about their "digital life", the accounts and assets someone would need to know about if something happened to them, they think about email, social media, maybe crypto, maybe cloud photo storage. Almost nobody thinks about their electricity retailer.
But an Origin Energy account isn't nothing. It holds your full name, address, date of birth, phone number, and partial banking details, exactly the profile a hacker wants, and exactly the profile an executor needs to actually close an account instead of leaving it running. It's linked to a direct debit. It's tied to a property. If nobody knows it exists, it doesn't stop just because the account holder has died, it keeps billing, keeps direct-debiting, and eventually turns into a debt collection problem for a family that's already grieving.
Utility accounts, power, gas, water, internet, mobile, sit in a strange blind spot. They're not exciting enough to think about as "digital assets," so they never make it onto anyone's list. They're also not the kind of account a will typically itemises, because wills deal with property and money, not "the Origin Energy account linked to the house." The result is a category of accounts that are simultaneously financially sensitive and completely undocumented, which is precisely the profile that makes them attractive to attackers and a nightmare to close after death.
The data doesn't disappear when the news cycle does
Here's the part that should sit uncomfortably longer than the headline does: whatever data was exposed in this breach doesn't have an expiry date. Names, dates of birth, and account details taken now can be used, or resold, or combined with other leaked datasets, for years. A breach like this isn't a single event that resolves once Origin sends out its notification emails. It's a permanent addition to the pool of information about you that exists outside your control.
That's true of the breach. It's also true, in a different way, of your own accounts while you're alive. Every account you open, energy, insurance, streaming, banking, crypto, cloud storage, becomes a small, permanent fact about your digital life, whether or not anyone else knows it exists. The accounts don't forget you even if your family would have no way of finding them.
What this actually means for your family
If something happened to you tomorrow, would whoever is winding up your affairs know that your Origin Energy account exists, which bank account it's linked to, and what needs to happen to close it? Multiply that by the average Australian adult's 150 to 300 online accounts, banking, super, subscriptions, crypto, social media, loyalty programs, and yes, utilities, and you get a sense of the actual scale of the problem.
This is the same blind spot a breach exposes, just running in the opposite direction. A breach reveals that a company you trusted had more of your data than you'd thought about, sitting somewhere you couldn't see. Death reveals that your family has less visibility into your accounts than they need, precisely when they need it most. Both problems come from the same root cause: nobody keeps a current, complete, accessible record of what actually exists.
A password manager solves part of this, it stores the login. It does not tell your executor that the Origin Energy account needs to be closed, that the direct debit needs to be cancelled, or that the final bill needs to be settled before the account gets referred to a collections agency. That's an instruction, not a credential, and most tools built for "digital legacy" don't distinguish between the two.
NYLK builds and maintains a professional inventory of your entire digital life, every account, not just the interesting ones, with verified executor release when your family needs it. Not because it would have stopped the Origin breach. Because when the moment comes that someone has to actually deal with your accounts, the ordinary ones as much as the sentimental ones, they'll have the record that makes it possible, instead of a stack of unopened mail and a mystery direct debit.
NYLK builds and maintains Digital Directives, a professional inventory of your entire digital life, with verified executor release when your family needs it.
Sources
Your digital life, held safe for the people you love.
NYLK builds the Directive that makes sure the people you love aren't locked out.
Start your Digital Directive →