Executive Summary

On 30 June 2025, Qantas detected unusual activity on a third-party platform used by an overseas airline contact centre. The OAIC’s later account states that an agent had been socially engineered on 28 June and that the attacker used the agent’s legitimate CRM access to connect a third-party data-extraction application; Qantas froze and revoked the associated account on 30 June. (oaic.gov.au ) Qantas publicly disclosed the incident on 2 July and subsequently reported approximately 5.7 million unique affected customers after removing duplicate records. (oaic.gov.au ; qantasnewsroom.com.au )

The exposed data varied by record. Approximately 4 million records contained names, email addresses and Frequent Flyer information; approximately 1.7 million contained some of those fields plus one or more of addresses, dates of birth, phone numbers, gender or meal preferences. (qantasnewsroom.com.au ) Qantas said credit-card, financial, passport, password, PIN and Frequent Flyer login data were not accessed. (qantas.com )

The intrusion was initially associated by commentators with Scattered Spider’s airline-targeting and vishing activity, but Qantas did not confirm that attribution. (abc.net.au ; theguardian.com ) Later reporting attributed publication and extortion activity to the collective called Scattered Lapsus$ Hunters; the provided sources do not establish that this collective was the same actor that obtained the Qantas access. (theguardian.com ) The record therefore does not support treating “ShinyHunters” as a confirmed Qantas intruder attribution.

The direct consequence was unauthorized collection of a large customer dataset from a vendor-connected contact-centre environment, as established by the OAIC’s account. The detailed OAIC findings describe approximately 5.67 million compromised records, while its foreword separately refers to approximately 5.12 million Australians and does not reconcile the figures. Collateral consequences included heightened phishing and impersonation risk, an NSW Supreme Court injunction, customer identity-protection support, regulatory scrutiny and later online publication of records. (oaic.gov.au ; qantas.com ; theguardian.com ) Qantas contained the incident, notified customers and agencies, and increased monitoring and access controls. (qantasnewsroom.com.au ) Current status is that the data was later reported released online while Qantas continued investigating the released subset and providing support. (qantasnewsroom.com.au )

Incident Overview

Chronology

• 28 June 2025: An overseas contact-centre agent received a call from a person impersonating “Qantas IT help.” The agent was induced to perform actions presented as closing an IT ticket. (oaic.gov.au )
• 30 June 2025: A Qantas employee responsible for the CRM platform noticed an unusual number of system-generated login-attempt alerts relating to 28 June. Qantas analyzed logs, identified an unauthorized login, froze and revoked the associated account, assessed impact and possible exfiltration, and activated incident response. (oaic.gov.au ) Qantas’s customer page identifies this as the date it detected unusual activity on a third-party platform used by an airline contact centre. (qantas.com )
• 2 July 2025: Qantas publicly disclosed the incident. (oaic.gov.au ) In its 2 July report, ABC said Qantas had informed the Australian Cyber Security Centre, OAIC and Australian Federal Police. At that point, the affected platform held service records for about six million customers, but Qantas was still determining what proportion had been stolen. (abc.net.au )
• 4 July 2025: According to a report based on court documents, self-described hackers sent Qantas several emails with redacted customer-data samples and a 72-hour response deadline. (peteraclarke.com.au ) 7 July 2025: The court-document account records a follow-up and Qantas reply; Qantas separately disclosed contact by a potential cybercriminal, and the AFP confirmed an investigation. These sources do not establish that the email sender or person making contact performed the intrusion. (peteraclarke.com.au ; theguardian.com )
• 9 July 2025: Qantas reported approximately 5.7 million unique affected customers after duplicate removal and began communicating each customer’s affected data fields. (qantasnewsroom.com.au ) It opened a 24/7 support line and continued coordination with the National Cyber Security Coordinator, ACSC and AFP. (qantasnewsroom.com.au )
• 17 and 23 July 2025: Qantas reported obtaining an interim NSW Supreme Court injunction and said it had no evidence that the stolen data had been released. It continued specialist monitoring. (qantas.com )
• 11 September 2025: Qantas’s customer information page, incorporating updates through this date, continued to describe containment, customer support, additional access controls and 24/7 monitoring. Its dated “no evidence” statements about release were from 17 and 23 July; the page does not independently resolve the later publication status. (qantas.com )
• October 2025: Later reporting said the Scattered Lapsus$ Hunters collective released Qantas records after an extortion-payment deadline. Qantas said data had been published and was investigating which data was included; the precise release date and released volume were not stated in the sources. (theguardian.com ; qantasnewsroom.com.au )

Affected environment and follow-up

The affected infrastructure was an overseas third-party contact-centre environment and its CRM/customer-servicing platform, not Qantas’s flight-operation or safety systems. (oaic.gov.au ; technologymagazine.com ) The platform contained customer contact profiles accessible to agents in the course of their duties. (oaic.gov.au ) Qantas said the affected information did not include payment, passport or account-authentication data. (qantasnewsroom.com.au )

Qantas engaged specialist legal and forensic experts, increased contact-centre resourcing, notified affected customers and offered identity-protection support. (oaic.gov.au ; qantas.com ) The OAIC conducted preliminary inquiries from 11 July 2025 to 1 June 2026 and closed them without commencing a Commissioner-initiated investigation or taking further regulatory action; its conclusion was preliminary rather than a permanent bar on later investigation. (oaic.gov.au ) The OAIC account records social engineering on 28 June and detection on 30 June, while court-document reporting says initial unauthorized access occurred on 1 July; the sources do not reconcile this discrepancy. (oaic.gov.au ; peteraclarke.com.au )

Technical Root Cause Analysis

Established failure chain

The strongest technical account comes from the OAIC’s preliminary inquiry report. Qantas contact centres were operated overseas by a third-party provider, and an agent had authorized access to customer contact profiles in the CRM platform as part of the agent’s normal role. (oaic.gov.au )

The attacker first used a phone call while impersonating “Qantas IT help.” On 28 June 2025, the agent was directed to a website related to the CRM platform and instructed to perform actions purportedly required to close an IT support ticket. Those actions connected the agent’s CRM instance to a data-extraction application controlled by the attacker. The application then extracted data from the customer profiles available to that agent. (oaic.gov.au )

The enabling weakness was not described as a remotely exploitable software defect. The CRM platform’s default configuration allowed an end user—the contact-centre agent—to authorize a third-party application connection. The OAIC reports that the software provider subsequently changed that default setting for all customers. (oaic.gov.au ) This created a trust-boundary failure: a user authorized for business data access could also authorize an external application to act against that accessible data, without a separate administrative or security approval boundary.

Security controls and mitigating factors

Qantas had role-based access controls that limited agents to information necessary for their duties. The OAIC assessed that those controls would not have prevented this attack because the attacker operated through a legitimate agent session and the third-party-application authorization default. This report characterizes that combination as broad access through a legitimate contact-centre role; it is an analytical description, not a concluded OAIC finding. (oaic.gov.au ) Qantas also had contact-centre cyber and data-protection training, had audited the overseas provider, and maintained processes for destruction and de-identification when information was no longer required. The OAIC nevertheless said conventional social-engineering training generally focuses on credential theft, and considered this less common legitimate-interaction attack likely to have succeeded even if standard training had been in place. (oaic.gov.au ; oaic.gov.au )

Detection depended on system-generated failed-login alerts. On the morning of 30 June, a Qantas CRM-platform staff member identified an unusual number of alerts associated with 28 June and escalated them to cybersecurity. Qantas then analyzed logs, identified an unusual unauthorized login, revoked and froze the account, assessed possible exfiltration and activated response procedures. (oaic.gov.au ) The available sources do not provide alert rule names, log excerpts, timestamps, IP addresses, API activity, application identifiers or exfiltration-volume measurements.

Data placement limited the categories present on the compromised platform. No credit-card details, personal financial information or passport details were stored on the platform, so Qantas said those categories were not accessed. Qantas also advised that passwords, PINs and Frequent Flyer login details were not accessed, and that the compromised information was not sufficient to gain access to Frequent Flyer accounts. (qantasnewsroom.com.au ; oaic.gov.au )

Unspecified product and vulnerability details

No source identifies the CRM product, provider, software version, CVE, CVSS score, cryptographic failure, protocol defect, malware, persistence mechanism or host-level compromise. (oaic.gov.au ; qantas.com ) The later Guardian report says Google analysis suggested a general voice-phishing method in which attackers impersonated IT support and persuaded legitimate staff to provide access to Salesforce; it does not establish that this was the Qantas-specific method. Salesforce separately denied that hackers broke into the platform through software vulnerabilities and said there was no sign that Salesforce itself was compromised. The Qantas-specific platform and method therefore remain unresolved rather than confirmed forensic findings. (theguardian.com ) Accordingly, this incident should not be assigned a CVE or described as exploitation of a Salesforce vulnerability on the available evidence.

Assessment boundaries

The OAIC found no apparent omission or failing by Qantas in its privacy-protection steps or its measures to ensure provider compliance, but it was reporting the outcome of preliminary inquiries and did not publish a concluded technical assurance report. (oaic.gov.au ) The technical root cause that can be stated precisely is therefore the combination of successful social engineering, a permissive third-party-application authorization default and broad data access through a legitimate contact-centre role—not an identified product exploit.

Attack Vector and Methodology

Initial access and authorization

The established initial-access method was phone-based social engineering, or vishing. On 28 June 2025, an attacker impersonated “Qantas IT help” when calling an overseas contact-centre agent. The attacker induced the agent to visit a CRM-related website and perform actions framed as closing an IT support ticket. (oaic.gov.au )

The attacker did not need to steal the agent’s password in the documented chain. The agent’s actions authorized an attacker-controlled data-extraction application to connect to the agent’s CRM instance. The application then collected records from the customer profiles that the agent was permitted to access. (oaic.gov.au ) This is an uncommon but important variation of social engineering: the victim is induced to grant delegated application access through legitimate product workflows rather than disclose a credential.

Collection and objective

The objective was customer-data collection from the contact-centre CRM. Qantas’s 9 July forensic update reported approximately 5.7 million unique customer records after duplicate removal; the OAIC separately found approximately 5.67 million compromised records, including overseas customers. These figures describe affected records, not a quantified exfiltration volume or the later released subset. (qantasnewsroom.com.au ; oaic.gov.au ) The majority of records contained names, email addresses and Frequent Flyer details; subsets also contained addresses, dates of birth, phone numbers, gender and meal preferences. (qantas.com )

The sources do not document privilege escalation, lateral movement, persistence, ransomware deployment, host compromise or evasion. The available intrusion chain is instead: telephone impersonation, user-directed navigation, delegated third-party application authorization and collection through the agent’s existing data scope. Later extortion and publication are addressed separately below; the sources do not quantify the exfiltration volume or establish that the released subset equaled all compromised records. No malware, command shell, exploit payload or post-compromise infrastructure is identified. (oaic.gov.au ; qantasnewsroom.com.au )

Detection and containment

Qantas detected the activity through system-generated login-attempt alerts. On the morning of 30 June, a CRM-platform staff member noticed an unusual number of alerts associated with 28 June and notified cybersecurity. Qantas’s investigation identified an unusual unauthorized login, after which it froze and revoked the associated account, analyzed logs and possible exfiltration, and initiated incident response. (oaic.gov.au ) Qantas later stated that no further threat activity was observed and that the system remained secure, although the sources provide no independent telemetry or indicators. (qantasnewsroom.com.au )

Attribution and extortion activity

Early reporting linked the incident by similarity to Scattered Spider’s contemporary airline campaign. CyberCX said the incident had the group’s hallmarks, while the FBI described Scattered Spider’s targeting of large corporations and third-party IT providers; Qantas did not confirm that attribution. (abc.net.au ) The Guardian also described the group’s known vishing pattern—impersonating employees or contractors to persuade support staff to grant access—but did not establish that it performed the Qantas intrusion. (theguardian.com )

After the intrusion, a self-described hacking collective emailed Qantas on 4 July, supplied redacted customer-data samples, imposed a 72-hour deadline and followed up when Qantas did not initially respond. Qantas replied on 7 July; court-related reporting records correspondence through 15 July, with substantial redactions. Qantas would not confirm whether a ransom was demanded, and the amount and full demands remain unknown. (peteraclarke.com.au ; theguardian.com ) Later reporting identified the collective reportedly releasing records after an extortion deadline as Scattered Lapsus$ Hunters. The available evidence does not prove that this reported publisher was the initial operator, and does not support a confirmed “ShinyHunters” attribution. (theguardian.com )

Indicators and forensic gaps

No IP addresses, domains, hashes, malware names, application IDs, API traces, command lines or other indicators of compromise are published in the sources. CVEs, affected product versions and detailed exfiltration mechanics are likewise not provided. (oaic.gov.au ) The principal defensive detection signals described in the sources are anomalous failed-login alerts, an unusual authorized login and unexpected third-party application authorization; the sources do not publish conventional IOCs such as IP addresses, domains, hashes or application IDs.

Impact Assessment

Scope and direct damage

The compromised environment was a third-party customer-servicing platform used by one Qantas contact centre. Qantas’s forensic update found approximately 5.7 million unique customer records after removing duplicates. (qantasnewsroom.com.au ) The OAIC’s findings describe approximately 5.67 million compromised records, including overseas customers. (oaic.gov.au ) These are consistent rounded estimates, but the OAIC foreword separately refers to approximately 5.12 million Australians and does not reconcile the figures. (oaic.gov.au )

Approximately 4 million records were limited to names, email addresses and Frequent Flyer details; within that group, approximately 1.2 million contained name and email address, while approximately 2.8 million contained name, email address and Frequent Flyer number, with most also including tier and smaller subsets including points balance and status credits. Approximately 1.7 million other records contained some preceding fields plus one or more additional fields. The detailed breakdown reported approximately 1.3 million records with an address, 1.1 million with date of birth, 900,000 with a phone number, 400,000 with gender and 10,000 with meal preferences. (qantasnewsroom.com.au ) Qantas reported no access to credit-card, financial, passport, password, PIN or Frequent Flyer login data. (qantas.com )

Operational and downstream effects

Qantas contained the incident on 30 June, engaged forensic specialists and established a 24/7 support line. It publicly disclosed the incident on 2 July and began notifying believed-impacted customers; around 9 July, it notified all impacted customers of their specific affected fields. (oaic.gov.au ; qantasnewsroom.com.au ) The sources do not report flight disruption, compromise of safety systems, confirmed fraudulent transactions, stolen points or a quantified financial loss. Technology Magazine reported Qantas’s statement that the breach should not affect flight operations or safety systems, while Qantas separately said Frequent Flyer accounts were not impacted and their credentials were not accessed. (technologymagazine.com ; qantasnewsroom.com.au )

The exposed combination of contact details, identity attributes and loyalty information increased the credibility of impersonation, password-reset and identity-theft attempts. Experts warned that attackers could use the information for targeted scams, account-recovery attempts and resale; Qantas later reported increased scams impersonating the airline. (abc.net.au ; qantas.com )

Legal, regulatory and reputational consequences

Qantas obtained an interim NSW Supreme Court injunction prohibiting access, viewing, release, use, transmission or publication of the stolen data. (qantas.com ) Later reporting said records were published online by the collective identified by the Guardian as Scattered Lapsus$ Hunters after an extortion-payment deadline; Qantas continued investigating which records were included. The precise number released and released-field breakdown remained unknown. Computing reported a different, less precise account—more than one million customers with phone numbers, dates of birth and addresses, plus another four million with names and email addresses—and also said Qantas was still investigating the release contents. (theguardian.com ; qantasnewsroom.com.au ; computing.co.uk ) The publication extended the impact from unauthorized access to public dissemination and raised continuing scam and privacy risks.

The OAIC conducted preliminary inquiries and closed them without a Commissioner-initiated investigation or further regulatory action, finding no apparent omission or failing in Qantas’s privacy-protection or provider-compliance measures. (oaic.gov.au ) That outcome was preliminary, and representative and individual complaints remained capable of case-by-case engagement. (oaic.gov.au ) Attribution and compensation remained unresolved in the cited material.

Recommendations and Prevention

The following are report recommendations derived from the documented failure chain, not formal recommendations made by the OAIC or Qantas. The OAIC made no breach-specific formal recommendations. (oaic.gov.au )

1. Make third-party application authorization deny-by-default

Qantas and other organizations should disable end-user approval of CRM-connected applications by default and require centralized approval, narrowly scoped OAuth/API permissions, short-lived tokens and an auditable approval record. This directly addresses the documented failure: the attacker induced an agent to connect an attacker-controlled extraction application through a legitimate workflow. (oaic.gov.au ) A concrete implementation is an allowlist of approved integration client IDs, with tenant-wide consent restricted to security administrators and automated revocation of newly granted or high-volume scopes. The CRM provider’s subsequent change to the default setting for all customers demonstrates that secure-by-default configuration was feasible. (oaic.gov.au ) Existing role-based access alone would not have prevented this incident; the OAIC specifically said it would not have defeated the delegated-application path. (oaic.gov.au )

2. Enforce phishing-resistant, transaction-bound approval for support actions

Contact-centre workflows that authorize integrations, change authentication state or expose bulk customer data should require a second approval from a security-controlled channel, preferably a phishing-resistant hardware-backed factor and transaction-specific confirmation. A phone caller impersonating IT should not be able to cause a single agent to authorize an external application. (oaic.gov.au ) For example, the CRM can require WebAuthn approval from a managed security-admin device and display the application identity, requested scopes, record volume and destination before authorization. The OAIC noted that the attack induced a legitimate system interaction rather than the usual credential theft and considered it likely to succeed despite standard training. This supports strengthening training for delegated-authorization abuse; the available sources do not establish that MFA would have failed in this incident. (oaic.gov.au )

3. Apply egress and behavioral controls to CRM data access

Treat bulk CRM reads and third-party API exports as high-risk data movement. Enforce per-user and per-application rate limits, destination allowlists, field-level authorization, export quotas and real-time detection of unusual record traversal. An implementation example is blocking any new integration from reading more than a defined threshold of profiles until a data-owner approval is recorded, while generating an incident for a rapid read across unrelated customers. This would have constrained the extraction application even after the agent’s legitimate access was abused. Qantas’s detection of unusual failed-login alerts and an unusual unauthorized login shows the value of monitoring, but the sources do not show that application-level extraction telemetry or egress prevention existed. (oaic.gov.au )

4. Make supplier assurance test delegated-access abuse, not only credential theft

Contracts and assessments for contact-centre providers should require evidence that integrations are deny-by-default, delegated tokens are scoped and revocable, high-risk actions are logged, and detection exercises cover vishing of agents and malicious OAuth/API authorization. Qantas had audited its overseas provider, provided training and maintained retention and deletion processes before the incident, and the OAIC found no apparent provider-compliance omission. (oaic.gov.au ) Regardless of the OAIC’s finding that Qantas showed no apparent provider-compliance omission, supplier testing should prospectively include a controlled scenario in which an agent is asked to close an IT ticket by connecting an unapproved extraction tool. The sources do not establish which exact tests Qantas performed or that this scenario was omitted.

Qantas’s post-incident measures—additional access restrictions, stronger monitoring and detection, more training, additional identification for Frequent Flyer account changes and specialist support—are appropriate containment and recovery measures. (qantas.com ; qantasnewsroom.com.au ) For customers, Qantas and government guidance specifically recommends independently verifying unexpected callers, using two-step authentication, not providing passwords or financial information, changing email passwords and reporting scams to Scamwatch. Customers should also not search for or attempt to access the leaked data, including their own material; the Cybersecurity Minister said doing so was illegal under the injunction. (qantas.com ; computing.co.uk ; theguardian.com ) These actions reduce downstream abuse but would not have prevented the original CRM authorization.

Conclusion

This incident demonstrates that role-based access controls do not by themselves protect customer data when a trusted employee in a third-party contact-centre/CRM environment can authorize a new application against an already-privileged session. The documented chain was a vishing call, a legitimate user workflow and attacker-controlled delegated extraction; no software exploit is identified in the available sources. (oaic.gov.au ) The material industry lesson is to treat application consent, API scopes and bulk data movement as security-sensitive operations subject to independent policy enforcement.

The event also illustrates the convergence of social engineering and cloud or SaaS trust abuse. Reporting associated the initial method with Scattered Spider’s airline campaign but did not confirm that attribution; later reporting identified Scattered Lapsus$ Hunters as the collective reportedly releasing records after an extortion deadline. (abc.net.au ; theguardian.com ) Organizations should therefore separate evidence of intrusion, evidence of extortion and evidence of publication rather than collapse them into a single actor label. The later publication, together with Troy Hunt’s reported criticism that the injunction was unlikely to deter criminals, supports the narrower inference that an injunction may not restore confidentiality once data has been copied and distributed. (nytimes.com )

The central lesson is to mature supplier assurance from policy review toward enforceable, observable controls over delegated access and data egress. The OAIC’s preliminary closure, while finding no apparent privacy-law failing, should not be read as evidence that the authorization design was low risk; the same report records the provider’s subsequent secure-default change. (oaic.gov.au ; oaic.gov.au )

• Report into preliminary inquiries of Qantas
• Information for customers on cyber incident
• UPDATE ON QANTAS CYBER INCIDENT: WEDNESDAY 9 JULY 2025
• UPDATE ON QANTAS CYBER INCIDENT
• Qantas Airways Says Hackers Leaked Data on Its Customers
• Qantas cyber-attack: what data was taken and what should ...
• Information for customers on cyber incident
• Qantas Responds - UPDATE ON JULY CYBER INCIDENT
• Privacy Commissioner completes preliminary inquiries into Qantas 2025 data incident
• Qantas hit by cyber attack, leaving 6 million customer ...
• Here's what the Qantas cyber attack may mean for your data ...
• Qantas contacted by suspected cyber criminal but airline ...
• Court records reveal details of communication ... - Peter A Clarke
• Five million Qantas customers have had personal information ...
• Qantas says stolen customer data published online months ...
• Inside the Cyberattack That Hit Six Million Qantas Customers