Qantas Customer Data Breached in Cyberattack — 'Aviation Security Emergency'

July 2, 2025: Australia largest airline Qantas officially announced a cyberattack resulting in customer data being leaked. The system has been blocked, but with up to 6 million customer information potentially leaked, warning alarms are sounding across global aviation security systems. Third-party platform-based indirect attack: this incident originated not from Qantas operational system itself but from hacking targeting an external customer support platform. Cybercriminals targeted one of Qantas customer service centers -- infiltrating a third-party customer response platform. Although this platform had a structure separated from Qantas official systems, approximately 6 million customer service records were confirmed stored there. Leaked information: name, email address, phone number, date of birth, Frequent Flyer number. Not leaked: passport information; credit card and financial information; login credentials, passwords, PIN numbers; Frequent Flyer account access was also stated to be unaffected. The third-party risk problem: Qantas core systems maintained good security -- but a customer support platform vendor had inadequate security; this is the "weakest link" problem in enterprise security; organizations now understand that their security posture includes all vendors and partners who have access to their customer data; supply chain and vendor security assessment has become as important as internal security; the Qantas incident joins a pattern of major breaches (Target 2013 via HVAC vendor, SolarWinds 2020 via software update) demonstrating that sophisticated attackers prefer indirect access through less-secured third parties over direct attacks on hardened primary targets.