Qantas confirms data of 5.7 million customers leaked online after cyberattack

Australian airline Qantas has confirmed that personal data belonging to approximately 5.7 million customers has been leaked online, months after a major cyberattack targeting a third-party service provider, now identified as Salesforce.

The breach, which occurred in early July, exposed sensitive information such as names, email addresses, phone numbers, dates of birth, and frequent flyer details. Some records also included addresses, gender, and meal preferences, though no financial or passport data was compromised, the airline said.

Qantas is among several global companies hit in a wider cyberattack on Salesforce, with reported victims including Google, Disney, IKEA, McDonald's, Toyota, and Air France-KLM. The attackers, believed to be linked to the Scattered Lapsus$ Hunters group, are holding the stolen data for ransom and reportedly set a deadline of October 10.

Qantas said it has taken legal action to prevent the data from being distributed and is cooperating with Australian authorities. However, cybersecurity experts warn such court orders have little real-world impact on cybercriminals operating outside legal jurisdictions.

The hack was reportedly carried out using social engineering techniques, with attackers posing as IT staff to trick employees into granting access—an approach the FBI recently warned about in relation to Salesforce-related attacks.

The incident adds to growing concerns about data security in Australia, which has seen a wave of major cyber breaches in recent years.