Qantas discloses cyberattack amid Scattered Spider aviation breaches

HELLFIRE

https://www.bleepingcomputer.com/news/security/qantas-discloses-cyberattack-amid-scattered-spider-aviation-breaches/
https://www.qantasnewsroom.com.au/media-releases/qantas-cyber-incident/

Australian airline Qantas disclosed that it detected a cyberattack on Monday after threat actors gained access to a third-party platform containing customer data. … In a press release issued Monday night, the airline states that the attack has been contained, but a “significant” amount of data is believed to have been stolen. …

Interesting is this nugget about the earlier WestJet breach : “BleepingComputer has learned that in the WestJet breach, threat actors exploited a self-service password reset to gain access to an employee’s account, which was then used to breach the network.”

Westjet thread here : https://broadbandbulletin.com/d/3784-westjet-investigates-cyberattack-disrupting-internal-systems

Regards

HELLFIRE

Picked up by TheRegister as well : https://www.theregister.com/2025/07/02/qantas_data_theft/

… The airline said the platform stored names, email addresses, phone numbers, birth dates and frequent flyer numbers for six million customers. Qantas did not use the system to store credit card details, personal financial information, or passport details. …

Regards

HELLFIRE

https://www.qantas.com/au/en/support/information-for-customers-on-cyber-incident.html – updated Jul 4th

… Qantas has not been contacted by anyone claiming to have the data … An initial review has confirmed the data includes some customers:

Names
Email addresses
Phone numbers
Dates of birth
Frequent Flyer numbers …

Regards

HELLFIRE

https://www.bleepingcomputer.com/news/security/qantas-is-being-extorted-in-recent-data-theft-cyberattack/ – Qantas is being extorted in recent data-theft cyberattack

Qantas has confirmed that it is now being extorted by threat actors following a cyberattack that potentially exposed the data for 6 million customers. … BleepingComputer contacted Qantas with further questions regarding the extortion and will update this article if we hear back.

Regards

HELLFIRE

https://www.theregister.com/2025/07/09/qantas_begins_telling_customers_data/ – Qantas begins telling some customers that mystery attackers have their home address

Qantas says that when cybercrooks attacked a “third party platform” used by the airline’s contact center systems, they accessed the personal information and frequent flyer numbers of the “majority” of the circa 5.7 million people affected. The Aussie airline said today this personal information includes names and/or email addresses, and warned frequent flyer numbers, customer tiers, status credits, and points balances might also be compromised. …

Sidebar has an explanation for the 6million to 5.7million number revision.

Regards

HELLFIRE

https://www.theregister.com/cyber-crime/2026/07/16/tech-support-scam-caused-massive-data-breach-at-australian-airline-qantas/5272267 – Tech support scam caused massive data breach at Australian airline Qantas

Australia’s Privacy Commissioner has revealed a tech support scam was the cause of the massive 2025 data breach at Australian airline Qantas and found the carrier didn’t breach its privacy obligations despite leaking personally identifiable information for 5.7 million customers. The Commissioner reached that conclusion, and a decision not to open a formal privacy probe, in a report published today … one thing the report doesn’t address is the identity of the attackers. …

Regards

vaxvms

HELLFIRE We tested the software thoroughly 😉 and found no problems therefore we can’t be held responsible.