The airline says customer data stolen via a third-party platform was published online after a July cyberattack, as experts warn of growing threats to the aviation sector.
Australian airline Qantas has confirmed that data from its customers was published online following a major cyberattack
In a statement the company said: “Qantas is one of a number of companies globally that has had data released by cybercriminals following a cyber-incident in early July, where customer data was stolen via a third-party platform. With the help of specialist cybersecurity experts, we are investigating what data was part of the release.
“Through the NSW Supreme Court, we have an ongoing injunction in place to prevent the stolen data being accessed, viewed, released, used, transmitted or published by anyone, including third parties.
“We have also put in place additional security measures, increased training across our teams and strengthened system monitoring and detection since the incident occurred.”
In July Qantas advised all impacted customers of the types of their personal data that was contained in the impacted system.
“We will continue to share updates on qantas.com and through our 24/7 support line (on 1800 971 541 or +61 2 8028 0534) where customers have ongoing access to specialist identity protection services,” the company said.
Qantas continues to work closely with Australian Government agencies, including the Australian Cyber Security Centre and the Australian Federal Police.
Industry experts have been giving their reaction to the news.
Dr. Ilia Kolochenko, CEO at ImmuniWeb, said: “Given that Qantas has many millions of customers and only five million records were leaked, we may conclude that the data breach has likely occurred because of a compromised third-party or an isolated system operated by Qantas, its vendors or subsidiaries.
“While there is no reason to panic, victims of the data breach may suffer fairly serious and long-lasting consequences. Augmented with freely available GenAI tools, social engineering and phishing attacks become quite sophisticated and smartly organised.”
Jamie Akhtar, CEO and Co-founder of CyberSmart, said: “It’s encouraging to see Qantas take a firm stance and refuse to pay the ransom demand following this attack. Too often, organisations feel pressured to give in to extortionists in the hope of quickly restoring operations, but paying a ransom only fuels the criminal ecosystem and offers no guarantee that stolen data will be recovered or deleted. Qantas’ decision aligns with global government guidance and sends a clear message that cybercriminals shouldn’t be rewarded for their actions.
“This incident also highlights how attackers are increasingly exploiting third-party connections to gain access to sensitive information. Businesses must treat every external integration as a potential entry point and apply least-privilege access, continuous monitoring, and regular security reviews to reduce their exposure. A Zero Trust mindset, where no user or system is automatically trusted, can make a major difference in containing breaches before they spread.
“Finally, preparation remains the most effective defence against ransomware. Having robust, offline backups, well-rehearsed incident response plans, and strong employee awareness can ensure that even if attackers gain entry, they can’t hold your business hostage.”
Richard Orange, VP EMEA at Abnormal AI, said: “As critical national infrastructure, airlines hold vast amounts of sensitive data and play a vital role in economic and national security. The Qantas breach is a stark reminder of the rising threat to the aviation sector, especially during peak travel season.
“The FBI has warned of increased targeting of airlines by groups like Scattered Spider, known for using advanced social engineering techniques.”
Jordan Avnaim, CISO at Entrust, said: “Social engineering attacks are evolving rapidly – fuelled by current events, AI-generated deepfakes, and increasingly convincing impersonation tactics. In addition, supply chain attacks are a common tactic for cybercriminals, who exploit contractors and third-party vendors as a path to gain access to larger objectives or high-value organisational targets.
“As we head into the busy summer travel period, it’s not surprising that threat actors have shifted focus towards the travel and aviation industry, where they can potentially create havoc by disrupting operational continuity and creating customer distrust. Defending against these risks requires more than perimeter controls – it demands continuous workforce education, Zero Trust principles, phish-resistant multi-factor authentication and identity verification that can’t be socially engineered. Security must be a standing board-level conversation, with ongoing investment in both technology and response readiness.”
