Qantas Hit by Massive Data Breach Exposing Six Million Customers
Australia’s Largest Cyberattack in Years Shakes Airline
Qantas revealed a major security incident on Wednesday: a hacker infiltrated a call center database, compromising the personal information of approximately six million customers. This breach, the most severe in Australia since 2022, deals a heavy blow to a company already struggling to regain public trust after a series of recent scandals.
What Information Was Compromised?
In a released statement, Qantas detailed that the attack exposed names, email addresses, phone numbers, dates of birth, and frequent flyer numbers. The airline detected the incident after noticing unusual activity on an external customer service platform and acted immediately to contain the damage.
While the exact amount of stolen data remains unclear, the company anticipates the volume to be significant. The location of the call center and the nationalities of affected customers were not specified.
Who Is Behind the Attack?
Although Qantas has not officially confirmed responsibility, suspicions point to the cybercriminal group known as Scattered Spider. The FBI recently linked this group to similar attacks on airlines like Hawaiian Airlines and Canada’s WestJet.
Mark Thomas, Director of Security Services at Arctic Wolf in Australia, highlighted the scale and coordination of these attacks. “It’s plausible they’re using a similar approach, impersonating technical staff to obtain employee passwords,” he noted.
Charles Carmakal, CTO of cybersecurity firm Mandiant (owned by Alphabet), stated it was premature to attribute the attack to Scattered Spider but warned that “airlines worldwide must be on high alert for social engineering attempts.”
→ Australian Qantas takes delivery of its first Airbus A321XLR
No Operational Impact, but Market Consequences
Despite the severity of the breach, Qantas assured that its operations and aviation security systems were unaffected. The airline also clarified that passwords, PINs, and frequent flyer account credentials were not accessed.
However, the news had an immediate market impact: Qantas shares fell 2.4% following the announcement, contrasting with a 0.8% rise in the broader market.
A Reputation Already Under Fire
The incident comes at a delicate time for Qantas. Since the pandemic, the airline has faced public scrutiny for decisions that eroded its prestige. It was found guilty of illegally laying off thousands of workers during the 2020 border closures while receiving government subsidies. The airline also admitted to selling tickets for canceled flights.
In 2022, Qantas faced criticism for allegedly pressuring the federal government to reject Qatar Airways’ request for additional flights to Australia—an accusation the airline denied but was cited by the consumer regulator as harmful to price competition.
Under CEO Vanessa Hudson, who took the helm in 2023, reputation metrics showed some recovery. Addressing the breach, Hudson stated, “We recognize the uncertainty this creates. Our customers trust us, and we take that responsibility extremely seriously.”
Post-Attack Measures
Qantas notified relevant authorities, including the Australian Cyber Security Centre, the Office of the Australian Information Commissioner, and the Australian Federal Police. The incident reignites debates about cybersecurity in critical service providers, echoing breaches at Optus and Medibank in 2022 that spurred legal reforms on digital resilience and mandatory incident reporting.
The Qantas attack not only jeopardizes the privacy of millions but also serves as another wake-up call for the airline industry. With massive databases and heavy reliance on technology, airlines have become prime targets for groups like Scattered Spider.
Related Topics
Flights Resume in London After Technical Failure in Air Traffic Control
Spain: Aena Launches Renovation and Expansion of Málaga-Costa del Sol Airport
Aerocivil Investigates Incident Involving a Minor at El Dorado Airport’s Control Tower
Venezuela: El Vigía Airport to Suspend Operations for 20 Days
Plataforma Informativa de Aviación Comercial con 13 años de trayectoria.