QANTAS Cyber Incident

[RooFlyer]

If QF get a ransom offer, because the info is supposedly already out there , Qantas would rightly say 'get stuffed. The next DSC will be on ....'.

 

[Princess Fiona]

And the good old Betoota
Savage but true
Betoota Advocate

 

[oz_mark]

Some boffin on ABC says it’s likely QF will get a ransom offer

If Scattered Spiders were indeed behind this, then that would likely have been part of their game plan (IMHO).

 

[justinbrett]

If Scattered Spiders were indeed behind this, then that would likely have been part of their game plan (IMHO).

They expect they are.

 

[henrus]

And the good old Betoota
Savage but true
Betoota Advocate

The chaps are funny but I've now had my "personal data" "breached" a few times thanks to Qantas, Optus and a few others but still haven't seen an uptick in spam/scam texts/emails however I know many non AFF community family/friends who've sent screen shots of scams to me to me to verify (something I continually happily do). End of the day it won't stop and I invite those who have managed to get my frequent flyer number to contact me and then fly on my behalf, I'll happily take the SC (qantas... this was a joke...).

 

[TheCollecter]

Work has recently gone with running a project thru an outsourcer (something new for them). Let’s call the outsourcer “Bozo” (not their real name). I heard thru a group call they’d been appointed (nothing in writing but a catchy name for sure). Next thing I get an email from “Bozo” asking to meet with me via Teams late the next evening to discuss best way forward (I ran the PoC personally, so I would be the obvious choice to get info from)

But no one else in the org was invited to the meeting… not the boss who approved it, not the stakeholder, not the SME

They dropped names (perfectly) of people and our equipment in the invite – obviously 100% legit ?

I straight away thought: either this is legit - or it is the mother of all social engineering vishing hacks, the sophistication of which will never be seen again

All I had was an email address form the inviter… bozo.something. But was that legit? Were the real company bozo.net or bozo.biz… they were offshore so bozo.com.country maybe?

I joined the meeting, thinking it was 100% legit, but still gave them no distinguishable company detail. Just instructions, like move it to the datacentre, then decommission it (with every how to step detailed, but not names or IPs). A very constructive meeting, and the gentleman (who was in Belfast of all places (their company was not based there)) was very grateful for my input as he got all he needed

SO IN CONCLUSION: I was invited to the call and had (a little) time to reflect and read the invite as many times as I wanted. Someone in an inbound call centre answers a call with no notice – the caller is hostile, angry, says I’ll have your job if you don’t help me RIGHT NOW… you have a family, you need this job… you are frightened… I feel for that person, I hope Qantas supports them through the trauma they must obviously be suffering

Oh, and if you don’t want humans in call centres making mistakes then stop hiring humans

 

[henrus]

Oh, and if you don’t want humans in call centres making mistakes then stop hiring humans

I mean I'd love a Qantas website that did every thing a QF call center could do...

That being said I love your external verification. I have access to our azure (with 20k+ ppl) and whilst strict better safe than sorry! QF has learnt the hard way permissions should be reduced!

 

[TheCollecter]

I mean I'd love a Qantas website that did every thing a QF call center could do...

You are a visionary! I want your vision to be real

 

[Dvg]

So I’m guessing it’s purely coincidental but my credit card that I use with Qantas just got hacked, 5 identical transactions for the same amounts, here we go again

 

[TheInsider]

So I’m guessing it’s purely coincidental but my credit card that I use with Qantas just got hacked, 5 identical transactions for the same amounts, here we go again

Correct, coincidental. Credit card details are entered into an Amadeus system for bookings and then tokenised, not the system that has been hacked recently. Amadeus has not been 'hacked'.
Probably been phished somewhere.

 

[TheCollecter]

purely coincidental but my credit card that I use with Qantas just got hacked

I truly hope it is coincidental - they are saying (I don't believe them) that there are only 6 million affected... I know the hassle you have to go thru given how many auto payments we all have these days... all the best and at the end of the day it's only hopefully 6-10 contacts you have to make, and most are online - not offshore call centres!!

 

[TheInsider]

I truly hope it is coincidental - they are saying (I don't believe them) that there are only 6 million affected... I know the hassle you have to go thru given how many auto payments we all have these days... all the best and at the end of the day it's only hopefully 6-10 contacts you have to make, and most are online - not offshore call centres!!

Once again, the booking system which takes payment and issues tickets has not been hacked.
Even if it was, the card details are tokenised and then every airline that uses the system would have the same problem and would clearly be more than 6mil people.

 

[Malus]

What I find interesting is that I still haven't received an email telling me about the breach. Neither has my husband. Both of us based in New Zealand, so I wonder if that's a factor? I'm gold, he's bronze.

 

[1A Please]

I’ve been a member since 2000 and WP most of this time. I cannot knowingly recall speaking to Manila Call Centre but I’m affected according to second email received from Qantas.

Interesting one, I have 1997 on my card, and cannot remember speaking to anyone in Qantas call centers for at least 20 years. Data retention rules should have removed that data from their systems in that time. But I did get the second email yesterday.

Worked in one the big banks Cyber team for a number of years and have some knowledge in this space. Its all about building profiles and stitching data together across multiple breaches over many years. Often hashed/encrypted passwords are also good to keep ... and sell. As computing power continues to increase over time, the ability and time needed to crack old passwords becomes easier and easir. Good reason to regularly rotate passwords and always use multi factor auth when available via an app, sms as a second.

 

[Pushka]

And the good old Betoota
Savage but true
Betoota Advocate

Bit ageist hey?

 

[SYD]

Data retention rules should have removed that data from their systems in that time.

But the data relates to their FF program. They can’t delete it - other than say closing inactive accounts?

 

[Pushka]

What I find interesting is that I still haven't received an email telling me about the breach. Neither has my husband. Both of us based in New Zealand, so I wonder if that's a factor? I'm gold, he's bronze.

No. We are in South Australia. Both WP. No emails received at all. Son, never used his QFF account but is a member with a FF number, also based in SA, did.

 

[AuSammy]

No. We are in South Australia. Both WP. No emails received at all. Son, never used his QFF account but is a member with a FF number, also based in SA, did.

Who is your email provider, their spam protection measures may have deleted the email before delivery.

Hotmail often used to block domains if a very large group message arrived in their portal; have improved their procedures in recent years.

 

[ozflier]

I have received an email saying that i was one of the affected members .
Interesting to know if there is a figure for the total numbers involved.
Interesting how Qantas is downplaying the risks associated with the loss of

• Names
• Email addresses
• Phone numbers
• Dates of birth
• Frequent Flyer numbers

I am not at all happy that this information of mine is now out there for whatever criminals or fraudsters want to do with it !

 

[AuSammy]

Given the hacks over recent years, i believe this incident has only added one data point to the information already “out there” - QFF member number. As long as the pin hasn't been captured then its a bit of ho-hum. I never use dob or simplistic pins like 1234, so they will have a bit of difficulty accessing my QFF account especially with the 3 attempts rule and MFA activated.

Thankfully QF doesn't hold DL numbers.

Of course, as always, don't fall for phishing emails and texts.