Qantas Data Breach

On June 30, 2025, Qantas detected unusual activity on a third-party customer service platform used by its Manila-based contact centre. Hackers gained access via social engineering (vishing) and exfiltrated customer records. The airline confirmed 5.7 million unique customers were impacted. In October 2025, the group Scattered LAPSUS$ Hunters leaked the data on the dark web after a ransom deadline passed.

Qantas is Australia's largest airline and national carrier. Like many large organisations, it relies on third-party vendors for contact centre operations, creating supply-chain security risks.

Attackers used vishing/social engineering to compromise a call centre worker, gaining access to a Salesforce-based third-party platform. The platform stored customer service records but did not contain payment card data or passports.

Vulnerabilities exploited

• Human vulnerability to vishing
• Third-party platform access controls

Scattered LAPSUS$ Hunters (linked to Scattered Spider tactics) – known for aggressive social engineering, vishing, and targeting large organisations via third-party vendors.

Aliases

• Scattered Spider
• SH

Attribution sources

• Qantas statements
• BleepingComputer
• The Guardian
• Cybersecurity researchers

Countries affected

• Australia
• Global

Data types

• PII
• Names
• Email addresses
• Phone numbers
• Dates of birth
• Frequent Flyer numbers
• Addresses
• Meal preferences

Reputational damage, increased scam activity targeting customers, regulatory scrutiny, and potential fines.

Public reaction

Significant customer frustration and concern over increased phishing/scam risks.

Political impact

Increased Australian government and regulatory focus on airline cybersecurity and third-party risk management.

Ongoing investigations by OAIC and potential class actions.

Civil lawsuits

• Anticipated class-action lawsuits and regulatory actions

Policy changes

• Stronger oversight of third-party vendors in critical industries.

Security improvements

• Enhanced vendor security assessments
• Improved monitoring of third-party platforms

Significance

One of Australia's largest customer data breaches in 2025, highlighting systemic third-party risks.

Legacy

Accelerated industry-wide improvements in supply chain security and third-party risk management.

Publishing organisations

• The Guardian
• BleepingComputer
• Reuters
• ABC News

Data leaked on dark web in October 2025; Qantas continues notifying customers and supporting scam prevention.

Official documents

• Qantas Cyber Incident Customer Page

References

1. [1]Qantas official statements
2. [2]The Guardian coverage
3. [3]Reuters reports
4. [4]BleepingComputer