QANTAS Cyber Incident

[clifford]

If they give the appearance of competence they’ll never get anywhere in my organisation! Dead giveaway!!

I imagine you might work for the Government.

 

[SeatBackForward]

What makes you think that being in Australia people don't fall for the same scams? It happens ALL the time.

Exactly. The problem here is outsourcing not offshoring. Unfortunately, the scruples of many who outsource is to go offshore.

 

[moa999]

Exactly. The problem here is outsourcing not offshoring. Unfortunately, the scruples of many who outsource is to go offshore.

Don't think it's even that.
No reason a fully Australian based call centre where all the employees were Qantas empliyees may not be susceptible to similar tactics.

Databases are unfortunately necessary tools today, but present massive risks and every company needs to look at controls around downloads, exports and encryption of specific fields (eg. DOB and of course passwords)

 

[Daver6]

Exactly. The problem here is outsourcing not offshoring. Unfortunately, the scruples of many who outsource is to go offshore.

I don't follow your logic. How does not outsourcing prevent staff from falling for a scam?

 

[LondonAussie]

Unfortunately it could happen to anyone anywhere. Obviously the Australian media isn’t reporting on the others, but the same group that breached Qantas also recently got into M&S, Harrods and Co-Op in the UK, then WestJet and Hawaiian Airlines, and several insurance companies in the US. They previously breached Visa, Ticketmaster, Louis Vuitton, Nike, T-Mobile, and Vodafone in the US.

I think there’s an assumption that in-house staff wouldn’t fall for the scams because they receive better training and just generally care about their jobs more, usually because they’re higher paid and higher skilled than the outsourced staff. I’m not sure how true that would be in reality.

 

[Spamam]

I’ve been hit by the data leak. What’s not clear is how social engineering lead to the leak of 6 million records. Social engineering can happen whether the operation is insourced or outsourced, all the attacker needs is a weak point. Somehow that weak point lead to the release of 6 million records without setting off an alarm until it was too late. The likelihood here is a legacy system with out of date controls was accessed by the hapless worker who was compromised. This is an industry that’s grants access to your flight details with a six digit code and your surname. Details that are held without encryption in random emails, your local travel agent and any airline on your journey.

Cross airline interoperability is dependent on this level of pre 1990s security. Now think what it takes to get the industry of 100s of airlines to move as fast as the attackers after them.