Qantas Customer Data Leaked: Names, Travel Records, and Loyalty Info for 5.7 Million Australians Now Public

Author: CyberDudeBivash — cyberbivash.blogspot.com | Published: Oct 12, 2025

TL;DR

Qantas has confirmed that customer data from a July cyber incident affecting a third-party contact-centre platform has been published by attackers — the incident affects about 5.7 million customers.
Qantas says the most sensitive items (payment cards and passport numbers) were not stored in the compromised system and were not accessed. For many customers the exposed fields are name, email, frequent-flyer details and — for a subset — phone numbers, dates of birth and addresses.
This post explains what customers should do right now, what organisations should check, and the practical steps to limit the damage from follow-on phishing, fraud and account takeover.

What happened (short)

Qantas confirmed that a cyber incident in July — where an attacker targeted a third-party customer servicing platform used by one of its contact centres — resulted in the compromise of records tied to approximately 5.7 million customers. The airline says forensic work is ongoing and that the system has been contained. Reuters and Qantas’ own updates report that personal contact details (names, emails) for about four million customers and more sensitive contact details (phone numbers, birth dates, addresses) for roughly one million customers were involved.

Has financial or passport data been exposed?

According to Qantas’ customer update, there is no evidence that credit card details, passport numbers or other payment information stored in separate systems were accessed in this incident. Qantas reiterates those fields were not kept in the compromised contact-centre system. Continue to follow official vendor updates for any changes to that assessment.

Why this still matters

Phishing & social-engineering risk:
Account takeover (ATO) attempts:
Credential reuse & fraud:

What Qantas customers should do right now (immediate checklist)

Change your Qantas account password — choose a unique, strong password you do not use elsewhere. If you use the same password on other sites, change those too.
Enable MFA / step-up authentication on your Qantas account (use app-based MFA or FIDO2/passkeys where available) and on any other important accounts that support it.
Be phishing-suspicious:
Monitor financial & loyalty activity:
Consider a credit-monitor or fraud alert if you are concerned (particularly customers whose addresses or DOBs were leaked). Your local consumer-fraud services or bank can advise on next steps.
Keep evidence:

What organisations (and security teams) should check

Look for targeted phishing campaigns:
Hunt for ATO signals:
Privilege & credential hygiene:
Customer support verification controls:

Hunting recipes & detection ideas (defensive)

These templates are intentionally platform-agnostic — adjust fields & thresholds to fit your SIEM/EDR.

# Hunt: sudden spike in password reset requests (pseudo-SQL)
SELECT user_id, COUNT(*) as resets
FROM auth_events
WHERE event_type = 'password_reset' AND event_time >= NOW() - INTERVAL '24' HOUR
GROUP BY user_id
HAVING resets > expected_threshold;

# Hunt: new device enrollments for frequent-flyer accounts
event.dataset: "auth" AND event.action: "device_register"
| where user.email_domain == "qantas.com" OR user.email IN (list_of_impacted_emails)
| stats count by device_id, user

Qantas & government response

Qantas says it has contained the affected system, is working with cybersecurity experts, and is notifying impacted customers directly via channels it controls. Australian authorities and national cyber incident response bodies have been engaged, and government spokespeople have reiterated a policy of not negotiating with or paying ransoms in these cases. Keep an eye on official Qantas communications for targeted guidance and times when Qantas will contact affected customers directly.

What to avoid — common mistakes

Don’t click links in unsolicited emails or SMS messages claiming to be from Qantas — use the official website or app to log in and check messages.
Don’t assume “no payment data accessed” means you’re safe from fraud — attackers commonly use personal details to socially engineer other services.
Avoid sharing screenshots of emails or leaked details publicly — that can amplify targeted scams against other customers.

Explore the CyberDudeBivash Ecosystem

Need help reacting to this incident?

Rapid IR coordination & forensic preservation
Customer phishing triage & notification templates
Detection engineering: hunts & SIEM rulepacks for ATO and credential abuse

Sources & verification

Qantas — official customer information and updates on the cyber incident (update: 12 Oct 2025).
Reuters — reporting that Qantas confirmed attackers published stolen customer data following the July breach (news update).
ABC / Australian public reporting — contextual reporting on the leak, affected fields and government response.
Various reputable news outlets summarising the published data and customer impact (aggregated reporting).

Hashtags:

#CyberDudeBivash #QantasBreach #DataBreach #AccountTakeover #Phishing #IncidentResponse

Cyberdudebivash