Qantas says 6 million customer accounts accessed in cyber hack

(Reuters) — A cyber hacker broke into a database containing the personal information of millions of customers, Qantas said, a setback for an airline rebuilding trust after a reputational crisis.

The hacker targeted a call center and gained access to a third-party customer service platform containing 6 million names, email addresses, phone numbers, birthdates and frequent-flyer numbers, Qantas said in a statement Wednesday.

The airline said the hacker did not access frequent flyer accounts or customer passwords, PIN numbers or log-in details.

“We recognize the uncertainty this will cause,” Qantas CEO Vanessa Hudson said of the data breach. “Our customers trust us with their personal information and we take that responsibility seriously.”

The airline said it learned of the breach after detecting unusual activity on the platform and acted immediately to contain it.

“We are continuing to investigate the proportion of the data that has been stolen, though we expect it will be significant,” Qantas said, reporting no impact on operations or safety.

Last week, the FBI said cybercrime group Scattered Spider was targeting airlines and that Hawaiian Airlines and Canada’s WestJet had already reported breaches. Qantas did not name any group.

Charles Carmakal, chief technology officer of Alphabet-owned cybersecurity firm Mandiant, said it was too soon to say if Scattered Spider was responsible but “global airline organizations should be on high alert of social engineering attacks.”

The breach is Australia’s most high-profile since those of telecommunications network operator Optus and health insurance leader Medibank in 2022 prompted cyber resilience laws including mandatory reporting of compliance and incidents.

It brings unwelcome attention to Qantas, which is trying to win public trust after actions during and after the COVID-19 pandemic. Qantas was found to have illegally sacked thousands of ground workers during the 2020 border closure while collecting government stimulus payments. It also admitted selling thousands of tickets for already-canceled flights.