FBI 2FA Bypass Warning Issued — The Attacks Have Started

Forbes

2 days ago

Qantas attacked days after FBI warning.
Just days after the Federal Bureau of Investigation issued a warning that Scattered Spider hackers were targeting new sectors with 2FA bypass attacks, those attacks have started. Qantas has confirmed that a data breach, potentially exposing the personal information of six million customers, successfully targeted a third-party supplier. As I have said previously, when the FBI issues a cybersecurity alert of any kind, everybody must pay close attention. Here's what you need to know and do.
Qantas Confirms Cyberattack Days After FBI 2FA Bypass Warning
The Australian airline, Qantas, is reaching out to customers with a warning that it has detected unusual activity on a third-party platform used to store the details of six million people. The information includes names, email, dates of birth and Qantas frequent flyer details. This comes just days after the FBI issued a warning to the aviation industry, stating that the Scattered Spider ransomware attack group, known for its attacks on the retail and insurance sectors, was shifting its focus to transportation and aviation in particular.
'The FBI has recently observed the cybercriminal group Scattered Spider expanding its targeting to include the airline sector,' an FBI spokesperson said in an email, adding that the attackers were employing 'social engineering techniques, often impersonating employees or contractors to deceive IT help desks into granting access.'
The Qantas Cyberattack Statement
A July 2 statement by Qantas regarding the incident has now been published, and confirms that 'the incident occurred when a cyber criminal targeted a call centre and gained access to a third-party customer servicing platform.' Exactly the attack route we see in Scattered Spider attacks.
Qantas has confirmed that it took immediate action on July 1 when the activity was detected, contained the system and that all other Qantas systems remain secure. 'There is no impact to Qantas' operations or the safety of the airline,' the statement said.
With six million customers at risk of data breach, Qantas has also confirmed that it is continuing to investigate the proportion of the data that has been stolen, but has said it expects 'it will be significant.'
No credit card or passport details have been impacted.
'We sincerely apologise to our customers and we recognise the uncertainty this will cause. Our customers trust us with their personal information and we take that responsibility seriously,' Qantas Group chief executive officer, Vanessa Hudson, said.
Worried customers can contact a dedicated support line on 1800 971 541 or [phone].