On 2025-07-02, Qantas confirmed that a third-party servicing platform used by a contact center was breached and that the system has since been contained [1]. The platform holds service records for 6 million customers; the company is still investigating the actual proportion of stolen data, preliminarily confirming that some names, contact details, dates of birth, and frequent flyer numbers were involved, while noting the platform's total user count should not be equated to the confirmed breach count [1]. Qantas stated that operations and aviation safety were unaffected, and that it has notified the Australian Cyber Security Centre, the Office of the Australian Information Commissioner, and the Australian Federal Police, while contacting customers to provide support [1].
Qantas Confirms Breach of Third-Party Customer Servicing Platform Affecting Customer Data
2 min read
- Disclosed
- Jul 2, 2025
- Published
- Nov 11, 2026
- Last updated
- Nov 7, 2026
- CVSS basis
- Our assessment
- Attack vector
- Impact
- Data type
- Actor type
- Motivation
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Transportation & logistics
What to do nowOur advice
Qantas stated that operations and aviation safety were unaffected, and that it has notified the Australian Cyber Security Centre, the Office of the Australian Information Commissioner, and the Australian Federal Police, while contacting customers to provide support [1].
Timeline
- Qantas discloses customer servicing platform cybersecurity incident[1]
Technical details
Officially Confirmed Scope
On 2025-07-02, Qantas confirmed that a third-party servicing platform used by a contact center was breached and that the system has since been contained [1].
The platform holds service records for 6 million customers; the company is still investigating the actual proportion of stolen data, preliminarily confirming that some names, contact details, dates of birth, and frequent flyer numbers were involved, while noting the platform's total user count should not be equated to the confirmed breach count [1].
Qantas stated that operations and aviation safety were unaffected, and that it has notified the Australian Cyber Security Centre, the Office of the Australian Information Commissioner, and the Australian Federal Police, while contacting customers to provide support [1].
The company stated that the system does not store credit card details, personal financial information, or passport details, and that frequent flyer accounts were not compromised nor were passwords, PINs, or login credentials accessed [1].
References
Official / primary1
- [1]
“The incident occurred when a cyber criminal targeted a call centre and gained access to a third party customer servicing platform.”
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.