Loading story…
Australia's privacy regulator found that the 2025 Qantas breach affecting about 5.67 million customers began with a sophisticated tech-support vishing scam against a contact center agent. An attacker posing as Qantas IT support persuaded the employee to visit a malicious site and take actions inside the airline's CRM environment, linking the platform to a data-extraction tool and enabling the theft of customer records.
The Office of the Australian Information Commissioner said Qantas had taken reasonable steps to protect personal information and declined to pursue a formal privacy investigation or find the airline in breach of the Australian Privacy Principles. The regulator cited prior audits of the contact center, recurring privacy and security awareness training, and role-based access controls, while noting the incident depended on an uncommon social-engineering technique and a default CRM setting. Exposed data included customer names, phone numbers, email addresses, and for some individuals addresses and dates of birth; no financial data or passwords were reported compromised.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Australia's Office of the Australian Information Commissioner concluded its preliminary inquiry into the Qantas breach and decided not to open a formal privacy investigation or hold Qantas responsible. The regulator found Qantas had taken reasonable protective steps, including audits, training, awareness testing, and role-based access controls, and said the attack was not reasonably foreseeable or preventable through stronger existing role-based access controls alone.
In June 2025, a threat actor used a sophisticated vishing or fake IT support social-engineering attack against a Qantas contact center agent, leading to access to the airline's CRM platform and theft of customer data. The breach affected about 5.67 to 5.7 million customers and exposed details including names, phone numbers, email addresses, and for some customers, addresses and dates of birth; no financial information or passwords were compromised.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourcescworld.com
Open sourcetheregister.com
Open sourceoaic.gov.au
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Qantas disclosed that a cyberattack exposed personal data belonging to about **5.7 million to 6 million customers**, making it one of the most significant airline-sector breaches reported in Australia. Early reporting said the incident affected customer records rather than flight operations, with exposed information understood to include personal and contact details held in airline systems. Coverage also linked the intrusion to the broader wave of attacks against airlines and travel firms attributed to **Scattered Spider**, a financially motivated threat group known for social-engineering tactics and extortion. Subsequent reporting said Qantas was among nearly **40 companies** facing ransom demands from the same hacker group, and that attackers later leaked data containing roughly **5 million customer records** after a ransom deadline passed. The leak escalated the incident from a large-scale breach to a public extortion event, increasing the risk of fraud, phishing, and identity abuse for affected customers while underscoring the aviation sector's exposure to coordinated intrusion-and-ransom campaigns.
Jul 12, 2026
Optus suffered a major breach that exposed personal information belonging to about 9.8 million current and former customers, including names, dates of birth, addresses, phone numbers, email addresses, and, for roughly 2.8 million people, passport or driver’s licence numbers. Australian officials publicly disputed Optus’s description of the intrusion as sophisticated, citing claims that an internet-exposed unauthenticated API and weak access controls enabled what the cybersecurity minister called a “basic hack,” while the company maintained a skilled criminal was responsible. The incident triggered investigations by the Australian Federal Police, the information commissioner, and ACMA, and intensified scrutiny of telecom-sector cyber oversight and penalties. A BreachForums user claiming responsibility demanded about **US$1 million** and threatened to publish stolen records in batches before later posting an apology and claiming the data had been deleted, a statement authorities did not verify. The fallout included identity-theft warnings, state support for replacing compromised licences, Optus-funded document replacement and credit monitoring, customer backlash over poor communications, and at least one criminal case involving alleged misuse of the stolen data to blackmail victims. The breach also led to a Deloitte review, court fights over disclosure of that report, customer losses, and a large class action as Australia moved to strengthen information-sharing and cyber laws.
Jun 29, 2026
A hacking group known as Scattered LAPSUS$ Hunters publicly released data stolen from the Salesforce environments of multiple companies, including Qantas and Vietnam Airlines. The group had previously threatened to leak data unless Salesforce or the affected companies paid a ransom, but the deadline passed without payment, prompting the attackers to publish data from six of the 39 companies they claimed to have compromised. The initial leaks included data from Qantas, Albertsons, GAP, Vietnam Airlines, Fujifilm, and Engie Resources. Qantas received significant media attention due to a court injunction it obtained in an attempt to prevent the use or dissemination of the stolen data, but the injunction proved ineffective as the data was still widely distributed. The attackers used multiple platforms to share the stolen information, including an onion site, a clear net forum, and a new clear net leak site, making the data accessible to a broad audience. For Vietnam Airlines, the breach resulted in the exposure of 7.5 million unique customer email addresses, along with names, phone numbers, dates of birth, and loyalty program membership numbers. The breach of Vietnam Airlines' Salesforce environment reportedly occurred in June 2025, but the data was not publicly released until October. The group’s leak strategy included charging for access to the data on some platforms, while later making it freely available on others. Despite initial claims of a massive leak affecting 39 companies, only six organizations' data was actually released, leading to speculation about the group’s motives and capabilities. The attackers communicated with followers via Telegram, providing updates and alternative download links when their primary leak site experienced technical issues. The incident highlighted the limitations of legal measures such as injunctions in preventing the spread of stolen data once it is in the hands of threat actors. Media and security experts, including Troy Hunt, provided commentary on the situation, emphasizing the inevitability of the data’s release and the challenges faced by affected organizations. The breach underscores the risks associated with third-party cloud platforms like Salesforce and the importance of robust security controls and incident response plans. Companies affected by the breach were advised to notify impacted customers, recommend password changes, and implement additional security measures such as two-factor authentication. The event also demonstrated the evolving tactics of cybercriminal groups in monetizing and publicizing stolen data, as well as the ongoing threat posed by supply chain and third-party breaches.
Jun 29, 2026