TL;DR: In July 2025, Qantas confirmed attackers reached a third-party customer servicing platform used by a call centre and took data on 5.7 million customers. About 4 million had names, emails and Frequent Flyer details exposed; about 1.7 million also had some mix of addresses (1.3M), birthdates (1.1M), phone numbers (900,000), gender and meal preferences. Qantas says no cards, financial data, passports, passwords or PINs were taken. Watch for Qantas-themed phishing.
What happened
Infosecurity Magazine reported that attackers accessed a third-party customer servicing platform via an attack on a call centre. The method bore hallmarks of the Scattered Spider group, known for talking helpdesk staff into resetting passwords, though attribution wasn’t confirmed.
What was taken
| Data | Customers |
|---|---|
| Name, email, Frequent Flyer details | ~4 million (1.2M of these name and email only) |
| Residential and/or business address | 1.3 million |
| Date of birth | 1.1 million |
| Phone number | 900,000 |
| Gender | 400,000 |
| Meal preferences | 10,000 |
| Cards, financial data, passports | Not taken |
| Passwords, PINs, logins | Not taken |
Ten thousand people’s meal preferences are now in criminal hands. Vegetarians of Australia, stay alert. (Seriously, it’s harmless on its own. The rest isn’t.)
Qantas emailed affected customers with the specific data types taken.
How to check
- Look for the Qantas email listing your data types.
- Check your email on our free exposure checker to see this and other breaches.
What Qantas advised
- Watch for phishing emails, texts and calls, especially ones claiming to be Qantas.
- Use multi-factor authentication on email and other accounts.
- Never give passwords or personal or financial information to anyone who contacts you claiming to be official.
- Check Scamwatch and the Australian Cyber Security Centre for current threats.
- See IDCARE and the OAIC for guidance.
Scams to expect
With your name, email, Frequent Flyer number and maybe your birthday:
- "Your points are expiring, log in to redeem" emails (see rewards points scams);
- fake flight cancellation refunds;
- "Qantas security" calls asking you to verify your account.
Log in through the Qantas app or by typing qantas.com yourself. Our Qantas scams guide covers more.
Your rights
If you’re unhappy with how Qantas handled your data, complain to Qantas first, then to the OAIC (how).
Frequently Asked Questions
How many people were affected by the Qantas data breach?
5.7 million customers, according to Qantas.
Were passports or credit cards stolen in the Qantas breach?
No. Qantas said no card, financial or passport data was compromised.
Were Frequent Flyer passwords or PINs leaked?
No. Qantas said no passwords, PINs or login details were affected.
How did the Qantas breach happen?
Attackers accessed a third-party customer servicing platform through an attack on a call centre.
Sources
- Infosecurity Magazine: Qantas confirms 5.7 million customers hit by data breach
- Reuters factbox via The Star: Major Australian data breaches