The airline had detected suspicious activity on 30 June and quickly contained the threat, notifying the authorities and launching an investigation

On 2 July 2025, Qantas Airways disclosed a major data breach affecting around 6m customers. The breach had occurred through a third-party customer service platform, resulting in the exposure of names, contact details, birth dates, and frequent flyer numbers, but not financial or passport information.

The airline had detected suspicious activity on 30 June and quickly contained the threat, notifying the authorities and launching an investigation. Its CEO has apologized, and assured customers of ongoing support.

While flight operations were unaffected, the incident has raised concerns about data security amid a series of recent cyberattacks in Australia (involving 600 customers of AustralianSuper and 16,000 records from Nine Media). Also, while specific details about how the attack occurred remain unclear, according to Kash Sharma, Managing Director, BlueVoyant, the incident reflects a broader regional trend: “Organizations are becoming increasingly vulnerable due to the size and complexity of their digital ecosystems — especially those involving third-party vendors and service providers.”

Charles Carmakal, CTO, Mandiant Consulting, has taken the opportunity to note: “Various threat actors use telephone-based social engineering to compromise organizations… Organizations that proactively train their help desk staff on robust identity verification processes and implement phishing-resistant multi-factor authentication are best equipped to thwart these types of attacks. Global airline organizations should (now) be on high alert for social engineering attacks and increase the identity verification rigor of their help desks.”

Noted Satnam Narang, Senior Staff Research Engineer, Tenable: “For users whose personal information may have been exposed, the biggest risk is follow-on social engineering attacks targeted against them. Without confirmation of password exposure, users don’t need to rush to change their passwords yet. However, users should ensure they use strong and unique passwords on each site, but most importantly, be sure that MFA is enabled on sensitive accounts to prevent credential stuffing attacks from being successful…”