A confirmed security incident at an Australian energy company has turned into a privacy and fraud problem, with attackers claiming customer data and threatening to publish it.