Australian airline Qantas confirms cybersecurity incident, no financial data compromised

LONDON: Qantas has reached out to customers following a cyberattack that targeted their third-party customer service platform.

On June 30, the Australian airline identified “unusual activity” on a platform used by its contact centre to store data belonging to six million individuals, including names, email addresses, phone numbers, birth dates, and frequent flyer numbers.

Once the breach was detected, Qantas took swift action to contain the system, according to an official statement.

The airline is still assessing the full scope of the breach, but it expects that a “significant” portion of the data was stolen.

Qantas reassured the public that sensitive information such as passport details, credit card data, and personal financial information were not stored on the compromised system. Additionally, no frequent flyer account passwords or PINs have been accessed.

Cyberattacks blight Britain’s retailers as M&S, Co-op’s systems’ breached

The company has notified relevant authorities, including the Australian Federal Police, the Australian Cyber Security Centre, and the Office of the Australian Information Commissioner.

Qantas Group CEO Vanessa Hudson expressed apologies to affected customers, acknowledging the concern this incident may cause. She advised customers to contact a dedicated support line if they have questions and affirmed that the airline’s operations and safety remain unaffected.

This cyberattack marks the latest in a series of data breaches in Australia this year, with notable leaks affecting AustralianSuper and Nine Media in recent months.

In March 2025, the Office of the Australian Information Commissioner revealed that 2024 was the worst year on record for data breaches in Australia since 2018.

Australian Privacy Commissioner Carly Kind commented that the increasing threat of cyberattacks is unlikely to lessen and urged both private and public sector organizations to enhance their cybersecurity measures and data protection protocols.