Qantas Data Exposure Impacts Up to 6 Million Customers

Australian airline Qantas confirmed in early July 2025 that a cyber-attack exposed personal data of up to 6 million customers. The breach occurred via a third-party customer servicing platform used by its contact center operations.

The exposed records include names, contact information, birthdates, and frequent flyer numbers—but no financial or passport data. The fallout led Qantas to launch a dedicated support line, bolster its incident response, and work with both the Australian Cyber Security Centre and federal police.

While the hackers have not been officially identified, analysts draw parallels to the Scattered Spider threat group, known for sophisticated social engineering, SIM swapping, and multi-factor authentication bypass techniques. Qantas has committed to notifying authorities and victims, reinforcing data access controls, and hiring independent experts to conduct forensic analysis.