QANTAS Cyber Incident

[RSD]

Customer can usually choose to receive by sms, email or app. The Macquarie bank App allows you to get one time codes without mobile coverage or internet access. Where there is a will there is a way.

Cant say I've ever needed to access My Gov when travelling, its only useful for downloading vaccination status before travel and submitting tax return which I don't do whilst overseas. YMMV,

App would normally be the best bet - but that would be relying on Qantas IT wouldn't it? Lets not go there!

I was in Egypt for nearly a year at the time - and had to submit monthly BAS statements - or try to...

 

[DejaBrew]

In ticketing system but not in the CRM. I stand by my lazy design comment.

Sensitive information should only be captured and stored for the purpose it was provided; there should be extra layers of access in order to view this data i.e. masking it on screen and only referencing it where needed to issue a ticket.

So many assumptions here.

Unless Qantas have officially confirmed it, the theory that the breached 3rd party platform is/was SFDC is pure speculation at this point because we know Qantas happen to use it as one of their multiple 3rd party technology platforms, and that it would clearly include customer data such as that which we know has been breached (due to Qantas officially confirming the data points impacted to date). However, logic would suggest that it's not the only 3rd party platform through which such data would flow. We are speculating as to mechanism of extracting these data points for some 5.7M unique customers. We are speculating that this platform did not have appropriate security in place. We are speculating that the individual who fell victim to the "vishing" attack was working in a role for which the relevant access rights/privileges to view the data points in question was completely inappropriate. We are speculating that there was insufficient training in place to safeguard against such social engineering hacks.

Look... I'm not saying your - or anyone else's - assumptions are 100% wrong, nor am I defending Qantas to the hilt. A data breach has occurred, we know it's impacted 5.7M customers and that it includes PII for at least a subset of the impacted customers. Of course that's not good. For all we know, the platform was indeed SFDC. For all we know, the security setup was lax. For all we know, there was no valid reason for the victim of the vishing attack to have had access to these data points. Qantas should cop a commensurate penalty for the breach once the facts are known by the relevant authorities. But until more concrete facts are disclosed to the public, this is all speculation and tantamount to the "experts" concluding that AI171 crashed due to pilot error and we should immediately dispense with reviewing the FDR etc to determine the facts of the incident.

 

[GrahamBRI]

We are speculating that this platform did not have appropriate security in place.

I am not sure that this one is a speculation? I understand Qantas admits that data was compromised on one of its systems. That to me is conclusive that security was not appropriate. “Security” includes all layers of defence (including the human layer, the physical layer and the data layer, etc…..). So just like we know the plane crashed, we know the security was breached….. this (the security being breached) is not appropriate (in the eyes of their customers).

 

[pauldab]

App would normally be the best bet - but that would be relying on Qantas IT wouldn't it? Lets not go there!

I was in Egypt for nearly a year at the time - and had to submit monthly BAS statements - or try to...

Qantas do support 2FA apps now for login to the website with an OTP and I've set that up as I prefer it to SMS which is inherently insecure.

BUT I checked my info today on the FF website and when checking my credit cards they used SMS not 2FA OTP already setup.

Qantas has gone some way but still have more to do.

 

[lovestotravel]

So many assumptions here.

Unless Qantas have officially confirmed it, the theory that the breached 3rd party platform is/was SFDC is pure speculation at this point because we know Qantas happen to use it as one of their multiple 3rd party technology platforms, and that it would clearly include customer data such as that which we know has been breached (due to Qantas officially confirming the data points impacted to date). However, logic would suggest that it's not the only 3rd party platform through which such data would flow. We are speculating as to mechanism of extracting these data points for some 5.7M unique customers. We are speculating that this platform did not have appropriate security in place. We are speculating that the individual who fell victim to the "vishing" attack was working in a role for which the relevant access rights/privileges to view the data points in question was completely inappropriate. We are speculating that there was insufficient training in place to safeguard against such social engineering hacks.

Look... I'm not saying your - or anyone else's - assumptions are 100% wrong, nor am I defending Qantas to the hilt. A data breach has occurred, we know it's impacted 5.7M customers and that it includes PII for at least a subset of the impacted customers. Of course that's not good. For all we know, the platform was indeed SFDC. For all we know, the security setup was lax. For all we know, there was no valid reason for the victim of the vishing attack to have had access to these data points. Qantas should cop a commensurate penalty for the breach once the facts are known by the relevant authorities. But until more concrete facts are disclosed to the public, this is all speculation and tantamount to the "experts" concluding that AI171 crashed due to pilot error and we should immediately dispense with reviewing the FDR etc to determine the facts of the incident.

Qantas hack that hit 6 million customers had ‘psychological’ edge

The attack on the country’s biggest airline comes amid a wave of breaches at North American carriers, including Hawaiian Airlines, prompting FBI warnings.

www.afr.com

Sales Salesforce....

Clearly insufficient training/warnings/safeguards - Or it wouldn't have happened

https://edition.cnn.com/2025/06/04/tech/hackers-abuse-modified-salesforce-app-to-steal-data-extort-companies-google-says

Along with many many other articles

Facts have been disclosed, Qantas isn't going to say much more or offer compensation,.

 

[DejaBrew]

I am not sure that this one is a speculation? I understand Qantas admits that data was compromised on one of its systems. That to me is conclusive that security was not appropriate. “Security” includes all layers of defence (including the human layer, the physical layer and the data layer, etc…..). So just like we know the plane crashed, we know the security was breached….. this (the security being breached) is not appropriate (in the eyes of their customers).

I understand the perspective, however I'm not sure it's quite so clear cut.

We can likely all agree and accept that impenetrable security is a myth. All that any individual/entity can do is to ensure that appropriate and commensurate security mechanisms and policies are in place, and then continuously and proactively maintain and enhance said mechanisms and policies in an attempt to keep pace with known and emerging threats.

If an employee or contractor fell for a vishing scam, then that's a security failure. Agreed. But the question would then be whether there was appropriate and ongoing training? If there was, then had this specific employee/contractor been trained? If so, then how long ago? These scams become more and more elaborate and convincing as time goes on, and I've certainly known very intelligent people who have fallen victim to scams that you or I might see through in an instant, but for whatever reason, they have not.

So we know the security was breached - much the same as, to your point, we know the plane crashed. However, much like the plane crash, the circumstances leading/contributing to the breach remain unclear.

Qantas hack that hit 6 million customers had ‘psychological’ edge

The attack on the country’s biggest airline comes amid a wave of breaches at North American carriers, including Hawaiian Airlines, prompting FBI warnings.

www.afr.com

Sales Salesforce....

Thanks for sharing. Unfortunately, this is paywalled link and even with the assistance of a 12ft ladder, I can't seem to peer over the wall to read the full article. Does it explicitly state as fact that Salesforce was the breached platform?

https://edition.cnn.com/2025/06/04/tech/hackers-abuse-modified-salesforce-app-to-steal-data-extort-companies-google-says
Along with many many other articles

Unless I've missed it, this article does not reference Qantas, nor does it reference Scattered Spider (i.e. the hacking group suspected - but not yet confirmed - as being behind this breach). That being said, I acknowledge that Scattered Spider is an offshoot of a larger group known as "The Com", and that the CNN article does suggest that technical infrastructure leveraged by the hacking group to which they are referring (i.e. "UNC6040") shares characteristics with suspected ties to The Com.

Clearly insufficient training/warnings/safeguards - Or it wouldn't have happened

Isn't this tantamount to arguing that if your house is broken into despite you having installed - and used - door/window locks, a back-to-base remote monitoring alarm, security cameras etc, that you clearly didn't ensure sufficient safeguards for your home? After all, if you'd implemented sufficient safeguards, then your residence wouldn't have been broken into.

To reiterate my earlier comment, impenetrable security is a myth. And that's not for a moment suggesting that Qantas should be given a free pass on this, especially if they are found to have been lacking in their security protocols.

 

[Aeryn]

Thanks for sharing. Unfortunately, this is paywalled link and even with the assistance of a 12ft ladder, I can't seem to peer over the wall to read the full article. Does it explicitly state as fact that Salesforce was the breached platform?

Yep direct quote from the AFR article "The breach occurred after an employee granted access to a third-party client service, software run by Salesforce, to the criminals, according to people briefed on the matter who requested anonymity to speak freely."

 

[DejaBrew]

Yep direct quote from the AFR article "The breach occurred after an employee granted access to a third-party client service, software run by Salesforce, to the criminals, according to people briefed on the matter who requested anonymity to speak freely."

Thanks for confirming that and providing the specific quote.

 

[GrahamBRI]

We can likely all agree and accept that impenetrable security is a myth.

Agree

All that any individual/entity can do is to ensure that appropriate and commensurate security mechanisms and policies are in place, and then continuously and proactively maintain and enhance said mechanisms and policies in an attempt to keep pace with known and emerging threats.

Agree - and partially to your point, we do not know yet, if the systems, monitoring in place met the expected standards of the day.

But, at the end of the day, systems were breached, and this is inappropriate, and whatever the vector(s) was/were, this needs to be fixed, with a change in Qantas's application of security and/or the industry standards being applied by Qantas...... so I am still holding firm that the security was not appropriate.

 

[OATEK]

Agree

Agree - and partially to your point, we do not know yet, if the systems, monitoring in place met the expected standards of the day.

But, at the end of the day, systems were breached, and this is inappropriate, and whatever the vector(s) was/were, this needs to be fixed, with a change in Qantas's application of security and/or the industry standards being applied by Qantas...... so I am still holding firm that the security was not appropriate.

I think we can all agree that the hack came from a known threat vector. What we don't know was what risk assessments had been carried out knowing the potential for such a threat, and whether too little was done to prevent the hack. But we can reasonably posit that not enough was done - the data tells us that (all 5.7m instances).

 

[outthere1000]

I can't speak for all but that is what they've advised me. Extract of the email is below:

View attachment 456519

Same for me. Name, FF number and tier. No mention of email address unless that is the "default" loss (i.e., every one of the 5.7 million email addresses was stolen).

 

[albatross710]

As a data point. My F-I-L received emails to say his account was included in the breech. It has been 12 years since he flew anywhere with Qantas. I book his tickets etc and haven't had any contact with them or even bothered with online access to his QFF account.

BTW, now would be a perfect time for a phishing scam in Qantas livery saying "due to the recent Qantas security breech, please follow this link to provide your latest information." Really any major corporation could be targeted like this.

 

[SeatBackForward]

Yep direct quote from the AFR article "The breach occurred after an employee granted access to a third-party client service, software run by Salesforce, to the criminals, according to people briefed on the matter who requested anonymity to speak freely."

Interesting wording. Were they criminals before or after they were given the access?

 

[DejaBrew]

But, at the end of the day, systems were breached, and this is inappropriate, and whatever the vector(s) was/were, this needs to be fixed, with a change in Qantas's application of security and/or the industry standards being applied by Qantas

Agreed. There need to be lessons learned from this incident for Qantas (and frankly, other organisations).

Again, to be clear, I'm not seeking to absolve Qantas of any blame or responsibility in my comments. Rather, whilst I acknowledge it obviously doesn't change the overall impact to customers, I'm simply suggesting that before everyone goes after Qantas with torches and pitchforks in hand, it would be more constructive to understand what went wrong (beyond the obvious) and whether this was a result of severe negligence, or something less nefarious.

 

[justinbrett]

Interesting wording. Were they criminals before or after they were given the access?

Before. Known hacking group with a notorious history (Scattered Spider).

 

[SeatBackForward]

Before. Known hacking group with a notorious history (Scattered Spider).

But to some extent, it indicates that they knowingly gave access to a bad actor. If that's the case it's not just an accidental data breach, but criminal intent by someone working at the call centre too.

I'm being pedantic here, but perhaps more appropriate wording was "employee granted access to someone who turned out to be part of the criminals".

 

[itchy feet]

Received the two emails last week. Yet to receive the one which informs me what of my information was leaked.

 

[AuSammy]

My first two QF emails went to spam. Anticipating a third I checked my spam folder just now and very unusually it’s totally empty . Must be International Spammers public holiday .

 

[I love to travel]

This should be free for everyone to read

Qantas hack will haunt affected customers for a long time, experts warn

With data of millions of Qantas customers out there, one security expert has warned that hackers will “have a very clean, very targeted list” of future victims.

www.theage.com.au

It will be interesting I think to also see (albeit from a distance) how the Board approach this - the Chairmans Lounge book suggested they were very hands off during AJ years. Time for more input about treating the customer well in these situations?

 

[ksthommo]

2nd email received this arvo

Our cyber security teams have undertaken an investigation and we can confirm that the following types of your data held on the compromised system was accessed:

Name
Email address
Qantas Frequent Flyer number
Tier
Points balance
Status Credits
Date of birth
Phone number