Qantas Confirms Customer Data Exposed After Massive Cyberattack

Australia’s national carrier, Qantas Airways, confirmed that customer data stolen in a major July cyberattack has been leaked online by cybercriminals. The airline revealed that it was among several global companies affected after hackers breached a third-party platform containing sensitive passenger information.

In July, Qantas announced that over one million customers had personal details — including phone numbers, birth dates, and home addresses — compromised in the attack. An additional four million customers had their names and email addresses accessed, making this one of the largest data breaches in Australia’s aviation history. The incident marks the most significant cyberattack since the 2022 breaches of telecommunications giant Optus and health insurer Medibank, which spurred the introduction of mandatory cyber resilience laws in Australia.

In a statement released on Sunday, Qantas said it is “one of a number of companies globally that has had data released by cybercriminals following the airline’s cyber incident in early July.” The airline added that it is working with cybersecurity experts to investigate the scope of the leaked information.

Qantas also confirmed that an injunction remains in place to legally restrict the use, viewing, or publication of the stolen data by any third party. While the airline declined to comment on media reports, The Guardian Australia attributed the data release to hacker collective Scattered Lapsus$ Hunters, who allegedly published the information after their ransom deadline passed.

The breach highlights growing concerns over cybersecurity in Australia’s corporate sector, emphasizing the urgent need for enhanced digital defenses across industries. Qantas continues to coordinate with cybersecurity authorities to mitigate potential risks to affected customers and protect its systems from future attacks.