Qantas confirms cyber breach affecting six million customers; contact and ID data compromised
Qantas says no impact on safety or operations
FBI has warned hacker group is targeting airlines
SYDNEY, July 2 — A cyber hacker broke into a database containing the personal information of millions of customers, Qantas said, in Australia's biggest breach in years and a setback for an airline rebuilding trust after a reputational crisis.
The hacker targeted a call centre and gained access to a third-party customer service platform containing six million names, email addresses, phone numbers, birth dates and frequent flyer numbers, Qantas said in a statement today.
The airline did not specify the location of the call centre or customers whose information was compromised. It said it learnt of the breach after detecting unusual activity on the platform and acted immediately to contain it.
'We are continuing to investigate the proportion of the data that has been stolen, though we expect it will be significant,' Qantas said, reporting no impact on operations or safety.
Last week, the US Federal Bureau of Investigation said cybercrime group Scattered Spider was targeting airlines and that Hawaiian Airlines and Canada's WestJet had already reported breaches. Qantas did not name any group.
'What makes this trend particularly alarming is its scale and coordination, with fresh reports that Qantas is the latest victim' of a hack, said Mark Thomas, Australia director of security services for cyber security firm Arctic Wolf.
Scattered Spider hackers are known to impersonate a company's tech staff to gain employee passwords and 'it is plausible they are executing a similar playbook', Thomas said.
Qantas' share price was down 3.3 per cent by mid-session trade against a flat overall market.
Unwelcome attention
The breach is Australia's most high-profile since those of telecommunications network operator Optus and health insurance leader Medibank in 2022 prompted cyber resilience laws including mandatory reporting of compliance and incidents.
It brings unwelcome attention to Qantas which is trying to win public trust after actions during and after the Covid-19 pandemic saw it plunge on airline and brand league tables.
Qantas was found to have illegally sacked thousands of ground workers during the 2020 border closure while collecting government stimulus payments. It also admitted selling thousands of tickets for already-cancelled flights.
The airline drew the ire of opposition politicians who said it lobbied the federal government in 2022 to refuse a request from Qatar Airways to sell more flights. Qantas denied pressuring the government which eventually refused the request — a move the consumer regulator said hurt price competition.
Qantas CEO Vanessa Hudson has improved the airline's public standing since taking office in 2023, reputation measures showed.
'We recognise the uncertainty this will cause,' Hudson said of the data breach. 'Our customers trust us with their personal information and we take that responsibility seriously.'
Qantas said it notified the Australian Cyber Security Centre, the Office of the Australian Information Commissioner and the Australian Federal Police.
ACSC declined to comment and AFP said only that it was aware of the incident. The OAIC was not immediately available for comment.
The airline said the hacker did not access frequent flyer accounts or customer passwords, PIN numbers or log in details. — Reuters
Hashtags
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Malaysian Reserve
an hour ago
- Malaysian Reserve
Sunsuria's Icon joint venture expands cancer care operations to Kuala Lumpur
SUNSURIA Bhd's healthcare joint venture, Icon Sunsuria Sdn Bhd, is expanding its operations to Kuala Lumpur with the establishment of its second cancer centre in Malaysia, scheduled to open by the third quarter of 2025. In a filing with Bursa Malaysia, Sunsuria said Icon Sunsuria has been appointed as the oncology provider under the 'Icon' brand at a medical centre in the capital city. This move follows the successful launch of its first centre in Penang. Icon Sunsuria is a joint venture between Australia-based Icon Asia Holdings Pte Ltd, which holds a 70% stake, and Sunsuria Integrated Healthcare Sdn Bhd (30%), a wholly-owned unit of Sunsuria Bhd. The expansion is part of the group's broader strategy to increase access to high-quality cancer care nationwide by leveraging Icon's internationally recognised care model and forming strategic partnerships with local healthcare providers. Sunsuria said the operational expansion will not have any material effect on the group's earnings for the financial year ending Sept 30, 2025. 'The board is of the opinion that the operation expansion is in the best interests of the company,' it said. — TMR
The Star
4 hours ago
- The Star
Australia's Qantas says 6 million customer accounts accessed in cyber hack
A member of the ground staff drives past a group of Qantas planes parked at the Qantas Domestic Terminal located at Sydney Airport, Australia, July 26, 2016. REUTERS/David Gray (Reuters) -A cyber hacker broke into a database containing the personal information of millions of customers, Qantas said, in Australia's biggest breach in years and a setback for an airline rebuilding trust after a reputational crisis. The hacker targeted a call centre and gained access to a third-party customer service platform containing six million names, email addresses, phone numbers, birth dates and frequent flyer numbers, Qantas said in a statement on Wednesday. The airline did not specify the location of the call centre or customers whose information was compromised. It said it learnt of the breach after detecting unusual activity on the platform and acted immediately to contain it. "We are continuing to investigate the proportion of the data that has been stolen, though we expect it will be significant," Qantas said, reporting no impact on operations or safety. Last week, the U.S. Federal Bureau of Investigation said cybercrime group Scattered Spider was targeting airlines and that Hawaiian Airlines and Canada's WestJet had already reported breaches. Qantas did not name any group. "What makes this trend particularly alarming is its scale and coordination, with fresh reports that Qantas is the latest victim" of a hack, said Mark Thomas, Australia director of security services for cyber security firm Arctic Wolf. Scattered Spider hackers are known to impersonate a company's tech staff to gain employee passwords and "it is plausible they are executing a similar playbook", Thomas said. Charles Carmakal, chief technology officer of Alphabet-owned cybersecurity firm Mandiant, said it was too soon to say if Scattered Spider was responsible but "global airline organisations should be on high alert of social engineering attacks". Qantas' share price was down 2.4% in afternoon trading against an overall market that was up 0.8%. UNWELCOME ATTENTION The breach is Australia's most high-profile since those of telecommunications network operator Optus and health insurance leader Medibank in 2022 prompted cyber resilience laws including mandatory reporting of compliance and incidents. It brings unwelcome attention to Qantas which is trying to win public trust after actions during and after the COVID-19 pandemic saw it plunge on airline and brand league tables. Qantas was found to have illegally sacked thousands of ground workers during the 2020 border closure while collecting government stimulus payments. It also admitted selling thousands of tickets for already-cancelled flights. The airline drew the ire of opposition politicians who said it lobbied the federal government in 2022 to refuse a request from Qatar Airways to sell more flights. Qantas denied pressuring the government which eventually refused the request - a move the consumer regulator said hurt price competition. Qantas CEO Vanessa Hudson has improved the airline's public standing since taking office in 2023, reputation measures showed. "We recognise the uncertainty this will cause," Hudson said of the data breach. "Our customers trust us with their personal information and we take that responsibility seriously." Qantas said it notified the Australian Cyber Security Centre, the Office of the Australian Information Commissioner and the Australian Federal Police. ACSC declined to comment and AFP said only that it was aware of the incident. The OAIC was not immediately available for comment. The airline said the hacker did not access frequent flyer accounts or customer passwords, PIN numbers or log in details. (Reporting by Shivangi Lahiri in Bengaluru and Byron Kaye in Sydney; Editing by Rashmi Aich and Christopher Cushing)
New Straits Times
7 hours ago
- New Straits Times
Australia's Qantas says 6 million customer accounts accessed in cyber hack
SYDNEY: A cyber hacker broke into a database containing the personal information of millions of customers, Qantas said, in Australia's biggest breach in years and a setback for an airline rebuilding trust after a reputational crisis. The hacker targeted a call centre and gained access to a third-party customer service platform containing six million names, email addresses, phone numbers, birth dates and frequent flyer numbers, Qantas said in a statement on Wednesday. The airline did not specify the location of the call centre or customers whose information was compromised. It said it learnt of the breach after detecting unusual activity on the platform and acted immediately to contain it. "We are continuing to investigate the proportion of the data that has been stolen, though we expect it will be significant," Qantas said, reporting no impact on operations or safety. Last week, the US Federal Bureau of Investigation said cybercrime group Scattered Spider was targeting airlines and that Hawaiian Airlines and Canada's WestJet had already reported breaches. Qantas did not name any group. "What makes this trend particularly alarming is its scale and coordination, with fresh reports that Qantas is the latest victim" of a hack, said Mark Thomas, Australia director of security services for cyber security firm Arctic Wolf. Scattered Spider hackers are known to impersonate a company's tech staff to gain employee passwords and "it is plausible they are executing a similar playbook", Thomas said. Charles Carmakal, chief technology officer of Alphabet-owned cybersecurity firm Mandiant, said it was too soon to say if Scattered Spider was responsible but "global airline organisations should be on high alert of social engineering attacks." Qantas' share price was down 2.4 per cent in afternoon trading against an overall market that was up 0.8 per cent. UNWELCOME ATTENTION The breach is Australia's most high-profile since those of telecommunications network operator Optus and health insurance leader Medibank in 2022 prompted cyber resilience laws including mandatory reporting of compliance and incidents. It brings unwelcome attention to Qantas which is trying to win public trust after actions during and after the COVID-19 pandemic saw it plunge on airline and brand league tables. Qantas was found to have illegally sacked thousands of ground workers during the 2020 border closure while collecting government stimulus payments. It also admitted selling thousands of tickets for already-cancelled flights. The airline drew the ire of opposition politicians who said it lobbied the federal government in 2022 to refuse a request from Qatar Airways to sell more flights. Qantas denied pressuring the government which eventually refused the request - a move the consumer regulator said hurt price competition. Qantas CEO Vanessa Hudson has improved the airline's public standing since taking office in 2023, reputation measures showed. "We recognise the uncertainty this will cause," Hudson said of the data breach. "Our customers trust us with their personal information and we take that responsibility seriously." Qantas said it notified the Australian Cyber Security Centre, the Office of the Australian Information Commissioner and the Australian Federal Police. ACSC declined to comment and AFP said only that it was aware of the incident. The OAIC was not immediately available for comment.
