Qantas data breach exposes up to six million customer profiles

Qantas, Australia’s largest airline, is reaching out to millions of its customers after a major cyber attack exposed personal information stored on a third-party customer service platform. On June 30, Qantas noticed unusual activity on a system used by its contact center, which holds data for about six million people. The information at risk includes names, email addresses, phone numbers, birth dates, and frequent flyer numbers. As soon as the breach was discovered, Qantas took immediate action to contain the system and prevent further damage. The company is still investigating the full impact, but it expects that a significant amount of data may have been stolen.

Qantas has reassured customers that sensitive details such as passport numbers, credit card information, and financial data were not stored in the affected system. Additionally, no frequent flyer accounts, passwords, or PINs have been compromised. The airline has reported the incident to the Australian Federal Police, the Australian Cyber Security Centre, and the Office of the Australian Information Commissioner. Vanessa Hudson, the CEO of Qantas Group, apologized to customers and acknowledged the uncertainty the breach may cause. She encouraged anyone with concerns to contact a dedicated support line and confirmed that the airline’s operations and safety have not been impacted by the cyber attack.

This incident comes shortly after the FBI in the United States warned that airlines are being targeted by cyber criminal groups, such as Scattered Spider. In the past two weeks, both Hawaiian Airlines and Canada’s WestJet have experienced similar cyber attacks. The BBC also reported that this group has targeted other major companies, including M&S. The Qantas breach is just the latest in a series of high-profile data leaks in Australia this year, with organizations like AustralianSuper and Nine Media also affected. In March 2025, the Office of the Australian Information Commissioner released data showing that 2024 was the worst year for data breaches in Australia since records began in 2018. Australian Privacy Commissioner Carly Kind stated that the threat of data breaches from malicious actors is unlikely to decrease. She urged both businesses and government agencies to strengthen their security measures, emphasizing that both private and public sectors are at risk of cyber attacks. As cyber threats continue to grow, protecting personal information remains a top priority for organizations and individuals alike.