In June 2025, Australian airline Qantas confirmed a data breach involving a third-party contact center platform. While the airline’s core systems and operations remained unaffected, the breach exposed the personal data of approximately 6 million customers—prompting not only an internal investigation but also an extortion attempt by the threat actor.

The incident has been contained, and no financial or sensitive identity documents were compromised. However, it highlights a growing trend in the cyber landscape: attackers are increasingly targeting third-party providers and turning breaches into extortion campaigns. For many organizations, this case underscores the importance of third-party risk management, rapid incident response, and transparent communication with customers.

At CSB, we believe there are valuable lessons for businesses in every high-profile breach. Below, we explore the key details of the Qantas case and share recommendations on how organizations can strengthen their own cybersecurity practices in response.

The Incident at a Glance

• Date disclosed: July 2025
• Affected organization: Qantas Airways
• Type of incident: Third-party data breach + extortion attempt
• Impacted data: Names, contact details, birth dates, frequent flyer numbers
• Systems affected: Third-party platform only (Qantas core systems unaffected)
• Operational impact: None reported
• Response: System secured, customers notified, law enforcement engaged

What Happened?

The breach occurred at one of Qantas’ external contact center providers, where a third-party platform was compromised by a threat actor. The platform, used for managing customer service records, contained personal information for millions of Qantas customers.

Data believed to have been accessed includes:

• Full names
• Email addresses
• Phone numbers
• Dates of birth
• Frequent Flyer membership numbers

No passport details, financial information, or credit card numbers were compromised, and Qantas has confirmed that Frequent Flyer accounts were not accessed or affected.

Following the incident, the compromised system was taken offline and secured. An internal investigation was launched, and the airline quickly notified the Australian Federal Police after receiving an extortion demand from the threat actor.

Company Response and Customer Communications

Qantas has taken a transparent and cautious approach throughout the process. Key actions include:

• Initial notifications sent to all Qantas Frequent Flyer members
• Additional messages sent to all customers aged 15 and above
• Follow-up communications scheduled to provide personalized details to affected individuals
• Proactive threat monitoring to detect any signs of leaked data online
• Clear warnings to customers about potential scams or impersonation attempts

Importantly, Qantas reported no further threat activity since securing the platform and is working closely with authorities to validate the claims made by the attacker.

The Rising Risk of Extortion and Impersonation

While data breaches are not new, the nature of post-breach tactics is evolving. In this case, the attacker did not simply exfiltrate data—they also contacted the airline directly, demanding a ransom. This extortion approach is becoming increasingly common, even in breaches where sensitive financial information isn’t involved.

Additionally, Qantas has reported a spike in phishing attempts and impersonation scams targeting their customer base—another trend that frequently follows publicized breaches. Attackers often use public awareness of an incident to create believable scam messages or fake websites in an effort to trick users into disclosing login credentials or personal information.

Qantas responded by alerting customers and reminding them to remain vigilant against:

• Emails requesting login details or booking references
• Phone calls pretending to be Qantas representatives
• Suspicious links or attachments

These types of social engineering tactics remain among the most effective tools in a cybercriminal’s arsenal.

Lessons for Businesses: Third-Party Risk Is Real

One of the most important takeaways from the Qantas incident is the critical role that third-party providers play in an organization’s overall security posture.

While Qantas’ own IT infrastructure and operational systems were not affected, the breach still exposed a large volume of customer data—illustrating how vulnerabilities in external platforms can lead to serious reputational and operational consequences.

To protect your business, consider the following best practices:

1. Conduct Regular Third-Party Risk Assessments

Review your vendors’ cybersecurity practices, policies, and incident response plans. Ensure they meet or exceed your organization’s security standards.

2. Implement Data Minimization and Segmentation

Limit the amount of customer data shared with third-party platforms, and ensure that data is segmented and encrypted where possible.

3. Strengthen Incident Response Plans

Include scenarios involving third-party breaches in your internal incident response planning. Predefined roles and communication channels save time and reduce confusion in a crisis.

4. Monitor for Post-Breach Threats

Use threat intelligence tools and services to monitor for signs of data leaks or impersonation attacks in the aftermath of a breach.

5. Keep Customers Informed

Timely, honest communication maintains trust. Provide clear instructions for how customers can protect themselves and where they can find updates.

Building Resilience Beyond Compliance

In today’s cyber landscape, compliance is not enough. Organizations must aim for resilience—developing the ability to prevent, detect, respond to, and recover from incidents swiftly and responsibly.

The Qantas breach is a strong example of responsible incident handling:

• The affected system was quickly isolated
• Law enforcement was contacted
• Customers were notified and supported
• Public trust was preserved through transparency

It also serves as a reminder that no system is immune, and that cyber resilience requires constant investment in people, processes, and technology—not just perimeter defense.