QANTAS Cyber Incident

[Laptop Jockey]

Has anyone actually registered for the class action

Yes (ironically required providing most of the data that was stolen from Qantas in the hack )

I don't expect any money, but we need companies to be accountable, especially for mandated over-collection of personal data for the express purpose of monetization.
Qantas' poor cyber security practises have been known for years in the industry, the biggest surprise is it took this long.
Between Qantas, Optus and NIB there probably aren't many working-age Australians that haven't been impacted by just these three incidents alone.

 

[SYD]

Yes (ironically required providing most of the data that was stolen from Qantas in the hack )

But you did anyway?

I don't expect any money, but we need companies to be accountable, especially for mandated over-collection of personal data for the express purpose of monetization.

Unless someone can prove loss directly from the hack, no one will see a cent other than the lawyers taking in the CA….

Qantas' poor cyber security practises have been known for years in the industry, the biggest surprise is it took this long.

The hackers actually used weakness in the Salesforce client - if anyone should be taking out class actions, it ought to be against Salesforce (and the 40 odd companies hacked the same way).

Between Qantas, Optus and NIB there probably aren't many working-age Australians that haven't been impacted by just these three incidents alone.

Yep. Unfortunately more to come….

 

[elanshin]

I think one thing people keep forgetting is that regardless of company or system, the weakest point is always us humans and if we are to look at history, we can see that there aren't very many things that can't be cracked open through the people.

As AI usage and sophistication increases, we're just going to see more and more breeches. It's completely possible to replicate someones voice and mannerisms with very short voice samples within seconds these days. I wouldn't be surprised if people could make AI video calls shortly too.

 

[Dvg]

Thanks. I didn't connect those dots. I think such action is shameful. Publishing actual personal data - of course. But 'banning' publication of information about whether that data has been used, is treating us with contempt.

How unusual of Qantas to treat us with contempt…….

 

[odysseus]

The hackers actually used weakness in the Salesforce client - if anyone should be taking out class actions, it ought to be against Salesforce (and the 40 odd companies hacked the same way).

It wasn't weakness in that software - as indeed, not all customers were 'hacked'.

They just utilised that software, in the same way scammers of old used to target if you had a Telstra account, or called you about "your Windows" or Westpac, or Australia Post and so on. If you then give them the keys to those accounts, they will then exploit what you gave them, in a similar way to what happened here.

 

[SYD]

It wasn't weakness in that software - as indeed, not all customers were 'hacked'.

They just utilised that software, in the same way scammers of old used to target if you had a Telstra account, or called you about "your Windows" or Westpac, or Australia Post and so on. If you then give them the keys to those accounts, they will then exploit what you gave them, in a similar way to what happened here.

Exactly. They knew how to get those keys to a common platform….

 

[RooFlyer]

Exactly. They knew how to get those keys to a common platform….

Wasn't it by asking the local operative (?call centre?) for access or the means to access, despite the local team being warned the day before, or so, that this may happen as it was happening to other companies, including airlines.

 

[Daver6]

I think one thing people keep forgetting is that regardless of company or system, the weakest point is always us humans and if we are to look at history, we can see that there aren't very many things that can't be cracked open through the people.

I'd agree.

Companies though should have systems in place so that when a breech does occur, the blast radius is minimised.

 

[elanshin]

Exactly. They knew how to get those keys to a common platform….

Wasn't it by asking the local operative (?call centre?) for access or the means to access, despite the local team being warned the day before, or so, that this may happen as it was happening to other companies, including airlines.

As I understand it, it wasn't a technical vulnerability as it was using legitimate functionalities of salesforce platform in the manner that it was supposed to be used. The attacker posed as coporate IT asking the unsuspecting target to log onto saleforce and put in a 8 digit code to authorise a connected app which the attacker had control over. Once they put that code in, it more or less gave them API-level access to the data.

In some sense its like the old "download a trojan" to your computer but in a much more sophisticated way. Some of the takeaways so far is that third party apps connected to saleforce should not be easily loaded and need to be white label approved first but these are settings and policies rather than vulnerabilities of a platform.

Also rumors that the hacker group are hinting theyve got data from Indian and Brazilian governments too.

 

[JustSlash]

I wouldn't be surprised if people could make AI video calls shortly too.

I’m afraid that already happened last year…

https://edition.cnn.com/2024/02/04/asia/deepfake-cfo-scam-hong-kong-intl-hnk

 

[OZDUCK]

Rumblings making into the Press

Frustration mounts among Qantas customers over data breach

The airline's customers voice their concerns and disappointment after cybercriminals release their personal data on the dark web.

www.abc.net.au

 

[Seat0B]

Has anyone actually registered for the class action

I just did. I'm really annoyed at the breach, but even more so at QF's attitude.

 

[Seat0B]

Yes (ironically required providing most of the data that was stolen from Qantas in the hack )

But you did anyway?

It only required name, address, phone and email for me to register with Maurice Blackburn, plus telling them the categories of data taken (but not the specific data). For me, as a business operator, name, phone and email are out there and I'm not too worried about that. Personal address is also not hard to find.

The one that annoys me the most is the DOB. That is not something I can change, and is a key piece of info used by many organisations I deal with as part of their identification process. And I didn't have to give that to Maurice Blackburn to join the class action.

 

[aikman]

Why do I get the feeling that after 3 months this will all be forgotten and everyone will be back to their usual "I Qantas" self.

 

[lovestotravel]

Why do I get the feeling that after 3 months this will all be forgotten and everyone will be back to their usual "I Qantas" self.

Some never blamed QF for the issue and are still the loving Qantas type

 

[moa999]

using legitimate functionalities of salesforce platform

The API may be legitimate..

But I'm not sure if being able to dump multi-million field databases across multiple different companies databases would have been the use case.

There clearly wasn't sufficient segregation, or limits on dataflows.

 

[moa999]

The one that annoys me the most is the DOB. That is not something I can change, and is a key piece of info used by many organisations I deal with as part of their identification process

It certainly shouldn't be however as that information is relatively easily (and cheaply) found. Even more so for the wealthy who are likely to be company directors.

 

[Pushka]

email today from Vietnam airlines. Travel was 18 years ago.

Dear Valued Customer,

Vietnam Airlines would like to inform you of a recent data breach involving a third-party customer service platform operated by a global technology partner. According to the service provider, Vietnam Airlines is among several global companies using its services that have been affected by this incident. A portion of customer data managed on this platform was accessed without authorization.

Upon being alerted, we took appropriate actions to coordinate with relevant authorities, cybersecurity experts, and the third-party partner to investigate the breach, assess potential impact and contain further unauthorized access to its system.

Some personal information may have been exposed, including full name, email address, phone number, date of birth, and Lotusmiles membership number. At this time, data such as payment information, passwords, travel itineraries, Lotusmiles balances, and passport details remain secure. Additionally, Vietnam Airlines’ internal IT systems were not affected.

To help protect your personal data, we recommend changing the passwords of your Lotusmiles and associated email accounts, staying alert to potential phishing attempts, suspicious emails or phone calls impersonating Vietnam Airlines, and avoid sharing information, one-time passcodes (OTPs), or login credentials with unverified sources.

Vietnam Airlines sincerely regrets any concern this incident may have caused. We are committed to keeping potentially affected customers informed with relevant updates as the investigation continues.

For any questions or assistance, customers are kindly requested to contact Vietnam Airlines Data Protection Office at [email protected], or via 24/7 hotlines: 1900 1100 (for calls within Vietnam), 1900 1800 (for Lotusmiles members calls within Vietnam), and +84 24 3832 0320 (for calls outside Vietnam).


Your sincerely,

Vietnam Airlines


I have yet to receive any email from Qantas.

 

[33kft]

But I'm not sure if being able to dump multi-million field databases across multiple different companies databases would have been the use case.

There clearly wasn't sufficient segregation, or limits on dataflows.

The problem is the nature of these plugins. Most of them are sales automatons - engage with or assign leads, etc. Needs customer details, and often needs a lot of them (as you're probably doing large campaigns). Not unusual to email your entire customer base from a plugin.

That said, there must be some ways to further abstract it out - keeping the data on-platform would be a much better solution, but that would probably require Salesforce to have all of the required integrations in place and customisable enough to be used across 3rd party apps.

But I think all of this is neither here nor there - in cybersecurity, Salesforce are known to be one of the worst players in the market. They actively paywall basic security capabilities (eg audit logs) for customers, seem to have zero interest in securing customer data whatsoever, I personally popped a cork when they were ransomed by Scattered Lapsus for their customer data, because nothing encourages change like being stuck between bad press and losing money.

 

[CaptJCool]

I know my DOB is out there as one of them junk emails asking for half a bitcoin to avoid my pawn search going to friends was sent to me. I laughed and thought gosh, they’ll see a whole new side of me. Queen trumps Jack,King