Qantas’ Massive Data Breach Affects Millions After Salesforce Hack

Qantas data Breach Exposes Information Of 5.7 Million Customers

October 12, 2025

Australian airline Qantas has confirmed a significant data breach affecting nearly six million customers, following the release of stolen information by cybercriminals. The incident underscores the growing threat of ransomware attacks targeting large corporations and sensitive data.

Breach Details and Scope

The compromised data, originating from a cyberattack in early July on Qantas’ third-party platform provider, Salesforce, includes a range of personal details. Affected information encompasses names, email addresses, frequent flyer program details, and residential addresses. Additionally, dates of birth, phone numbers, gender, and, in certain specific cases, sexual preferences were exposed.

Crucially, Qantas asserts no credit card details, financial records, or passport information were accessed during the breach.Similarly, passwords, PINs, and login credentials for frequent flyer accounts remain secure. Cybersecurity expert Troy Hunt confirmed the extent of the data exposure, noting his own family’s information was among the stolen records.

Global Impact and Extortion Attempts

This breach isn’t isolated to Qantas. Documents belonging to 39 major global companies-including Disney, Toyota, and FedEx-were also compromised by the same hacking group, known as Raps Dollar hunters. The group initially demanded an unspecified extortion payment from salesforce,threatening to release the stolen data if their demands were not met. Salesforce refused to comply.

The stolen data was initially removed following intervention from authorities, but reappeared Sunday morning on a different hosting service, demonstrating the difficulty of fully containing such breaches. Hunt emphasized the widespread availability of the data, noting its presence not only on the dark web but also on publicly accessible platforms.

Qantas Response and Legal Ramifications

Qantas has initiated an investigation with cybersecurity experts,and is actively working to mitigate the impact of the data release.The New South Wales Supreme Court issued an injunction to prevent the further distribution of stolen data, but the material remains accessible in some forms. Affected customers are being offered support and guidance on protecting their identities.

Legal experts anticipate potential class action lawsuits against Qantas, mirroring a similar case following a major data breach at Optus in 2022, which impacted over 10 million customers.

The Rise of ‘Privacy Attacks’

Cybersecurity professionals are increasingly concerned about the emergence of “privacy attacks,” where hackers steal data specifically for extortion rather than traditional financial gain. This shift complicates incident response, as negotiation with criminals doesn’t guarantee data deletion. According to a recent report by Sophos, ransomware attacks increased by 35% in the first half of 2024, with a growing focus on data exfiltration. Sophos State of Ransomware Report

Breach	Customers Affected	Year
Qantas	5.7 Million	2025
Optus	10+ Million	2022

Protecting yourself After a Data Breach

Data breaches are becoming increasingly common, so it is vital to take steps to protect your personal information. Here are some best practices:

• Monitor Your Accounts: Regularly check your bank statements and credit reports for any unauthorized activity.
• Change Passwords: Update passwords for critically important online accounts, using strong, unique combinations.
• Be Wary of phishing: Be cautious of suspicious emails, text messages, or phone calls requesting personal information.
• Enable Multi-Factor Authentication: Add an extra layer of security to your accounts by enabling MFA whenever possible.

Frequently Asked Questions about the Qantas Data Breach

What type of Qantas data was stolen in this breach?

the breach exposed names, email addresses, frequent flyer details, addresses, dates of birth, phone numbers, gender, and sexual orientation.

Was my financial information compromised in the Qantas data breach?

no, Qantas has stated that no credit card details or financial information were stolen.

What is salesforce’s response to this data breach?

Salesforce has stated they will not negotiate or pay any extortion demands.

What should I do if I am affected by the Qantas breach?

Qantas is providing support pathways and identity conservation advice to affected customers. It’s crucial to monitor accounts for suspicious activity.

Are ransomware attacks becoming more frequent?

Yes, ransomware attacks are on the rise, with a growing trend of hackers stealing data for extortion purposes.

Do you think companies are doing enough to protect customer data? Share your thoughts in the comments below!

What obligations does Qantas have under the Australian Privacy Act 1988 following this data breach?

What Happened in the Qantas Data Breach?

On October 12, 2025, Qantas Airways confirmed a meaningful data breach impacting approximately 9.9 million current and former customers. The breach stems from a cyberattack targeting Salesforce, a customer relationship management (CRM) platform widely used by Qantas for storing customer data. This incident represents one of Australia’s largest data breaches to date, raising serious concerns about data security and privacy. The compromised data includes names, email addresses, dates of birth, phone numbers, frequent flyer details, and, for some customers, passport details and credit card numbers.

Understanding the Salesforce Connection

Qantas utilizes Salesforce to manage a substantial portion of its customer interactions and data. The vulnerability exploited within Salesforce allowed unauthorized access to Qantas’ customer database. while Salesforce itself wasn’t directly breached, the attack targeted Qantas’ specific implementation and access controls within the platform. This highlights the importance of robust security measures even when utilizing a secure third-party provider. The incident underscores the shared duty model in cloud security – Salesforce secures the platform, but Qantas is responsible for securing the data within the platform.

What Data Was Compromised? A Detailed Breakdown

The scope of the Qantas data breach varies depending on the individual customer. Here’s a breakdown of the types of data potentially exposed:

* Frequent Flyers: Names, email addresses, dates of birth, phone numbers, frequent flyer numbers.

* Passport Details: For a subset of customers, passport numbers and expiry dates were accessed. This poses a significant identity theft risk.

* Credit Card Information: A limited number of customers had their credit card details (card number,expiry date,and CVC) compromised. Qantas has stated these details were stored securely and tokenized, but the risk remains.

* General Contact Information: Names, email addresses, and phone numbers for a large portion of the affected customer base.

Immediate Steps Qantas is Taking

Qantas has initiated several measures in response to the breach:

1. Containment: Immediately isolating the affected systems and working with cybersecurity experts to contain the breach.
2. Inquiry: Conducting a thorough forensic investigation to determine the full extent of the compromise and identify the root cause.
3. Notification: Notifying affected customers via email and SMS, providing guidance on steps to take to protect their information. (see “What You Should Do Now” below).
4. Enhanced Security Measures: Implementing enhanced security protocols and monitoring systems to prevent future incidents.
5. Collaboration with Authorities: Working closely with the Australian Federal Police (AFP) and the Office of the Australian Information Commissioner (OAIC).

What You Should Do Now: Protecting Your Information

If you are a Qantas customer, its crucial to take proactive steps to protect your personal information:

* Change Passwords: Immediately change your Qantas Frequent Flyer password and any other online accounts where you use the same password. Use strong, unique passwords.

* Monitor Accounts: Closely monitor your bank and credit card statements for any unauthorized transactions.

* Be Alert for Phishing: Be wary of phishing emails or phone calls attempting to obtain your personal information.qantas will not ask for sensitive information via these channels.

* Consider a Credit Freeze: If you are concerned about identity theft, consider placing a credit freeze on your credit reports.

* Report Suspicious Activity: Report any suspicious activity to your bank, credit card provider, and relevant authorities.

* Review Qantas Booking Details: Use the Qantas website (https://help.qantas.com/support/s/article/View-flight-bookings-made-online) to review your booking details and ensure accuracy. Be aware that booking references do not include 0 or 1.

The Broader Implications for Data Security

The Qantas data breach serves as a stark reminder of the escalating cyber threats facing organizations of all sizes. Several key takeaways emerge:

* Third-Party Risk Management: Organizations must rigorously assess and manage the security risks associated with third-party vendors, including cloud service providers.

* Access Control: Implementing robust access controls and the principle of least privilege is critical to limit the potential impact of a breach.

* Data Encryption: Encrypting sensitive data both in transit and at rest is essential to protect it from unauthorized access.

* Incident Response Planning: Having a well-defined and tested incident response plan is crucial for effectively containing and mitigating the impact of a data breach.

* Continuous Monitoring: Continuous security monitoring and threat detection are necessary to identify and respond to emerging threats.

Legal and Regulatory Considerations

The Qantas data breach is highly likely to trigger investigations by the OAIC and potentially lead to significant penalties under the Australian Privacy Act 1988. Organizations that experience a data breach are legally obligated to notify affected individuals and the OAIC if the breach poses a serious risk of harm.The OAIC has the power to investigate breaches