Qantas data breach: Here's what was stolen in cyberattack, what the airline said, and what you can do

Australian aviation major Qantas Airways on July 9 admitted that hackers had accessed personal information belonging to 5.7 million customers, Bloomberg reported.

This is Australia's most high-profile cyber attack since telecommunications giant Optus and health insurer Medibank were hit in 2022, as per a Reuters report.

The airline’s shares were trading up 1.1 per cent in Sydney, as per the report.

What data was lost in cyberattack?

The data breach, which occurred last week, compromised customer details ranging from passenger names, addresses, phone numbers and meal preferences, the report added.

Over one million passengers had their phone numbers, birth dates or home addresses accessed, according to the Reuters report. An additional four million customers had their names and email addresses stolen during the hack.

What Qantas said about cyberattack…

Qantas on July 9 said it has begun telling impacted passengers what specific information was lost in the attack.

The BB report added that there is “no evidence” that any of the stolen data was released in public, the carrier said it is “monitoring the situation with the help of specialist cybersecurity experts”.

An analysis conducted by the airline since the hack found that the financial impact at this time is “limited”, as there were no credit card details or other financial data compromised in the breach. The status on this could, however, change pending more information, the report added.

Further, on frequent flier miles, Qantas stated that not enough data was stolen to grant the hackers access to this information.

Qantas CEO Vanessa Hudson under scrutiny

The report added that while the “damage appears to be contained”, the cyberattack has raised concerns over CEO Vanessa Hudson's crisis management.

Since taking over in 2023, she has worked to gain back the reputation lost by predecessor Alan Joyce, it added.

What can affected Qantas customers do?

• In the statement on July 9, Hudson said the carrier has advised affected customers on steps to contact and access necessary support services. 
• She added that since the incident, Qantas has put in extra security measures and will continue to review what happened. 
• Another safety measure customers can take is to change the passwords to emails, accounts, and apps that could be linked to the leaked data. 
• Implement two-factor authentication for all logins and contact your bank, post or other relevant authorities to inform them of the potential breach.

Qantas joins a growing list of airlines suffering hacking breaches in recent weeks, including Alaska Air Group Inc.’s Hawaiian Airlines and Canada’s WestJet Airlines.

The US Federal Bureau of Investigation has warned that the notorious cybercrime group Scattered Spider was targeting airlines using techniques that impersonate employees or contractors to hack into IT systems.

(With inputs from Bloomberg and Reuters)