Overview
- Qantas detected unusual activity on June 30 in a third-party contact centre platform and swiftly contained the breach with no impact on flight operations or safety.
- The compromised system held service records for up to six million customers, exposing names, email addresses, phone numbers, birth dates and frequent flyer numbers.
- The airline confirmed that credit card details, personal financial information, passport data, account passwords and PINs were not stored on the affected platform.
- Qantas has notified the Australian Cyber Security Centre, the Office of the Australian Information Commissioner and the Australian Federal Police, and has set up a dedicated support line for affected customers.
- Cybersecurity firm CyberCX has indicated the breach bears the hallmarks of the Scattered Spider hacker group, though formal attribution remains unconfirmed as Qantas investigates the full extent of data theft.