Qantas Cyberattack Reveals Personal Data Of Millions In Unprecedented Breach, Raising Alarms Over Third-Party Platform Security

Written By: Sanjana Dubey

Sanjana Dubey

A passionate storyteller and emerging journalist, I am currently doing job while diving deep into the world of journalism. With two years of practical experience, I have cultivated a knack for transforming ideas into engaging narratives that captivate readers. My journey blends academic insight with real-world reporting, allowing me to explore culture, travel, and lifestyle through a creative and informed lens. Committed to delivering fresh, authentic, and impactful content, I strive to make every story not just read, but truly experienced.

See Full Bio

October 14, 2025 11:27 AM

Image generated with Ai

Over five million Qantas customers have fallen victim to a major data breach, exposing their personal information through a cyberattack linked to vulnerabilities in Salesforce, a third-party platform. Despite the airline’s assurances that sensitive data like credit card details and passwords were not compromised, the leak still includes valuable personal information such as names, email addresses, and frequent flyer details. This incident not only highlights Qantas’ security shortcomings but also raises serious concerns about the risks associated with relying on third-party platforms for data storage. The breach is part of a larger wave of attacks targeting businesses using Salesforce, emphasizing the urgent need for robust data protection measures across all digital platforms.

Around 5.7 million customers of Qantas Airlines have been affected by a significant data breach, which was first reported in early July. The breach occurred when personal information was accessed through a third-party platform, Salesforce, which stores data for a wide range of companies. The airline has stated that this cyberattack involved unauthorized access to a portion of customer data, leading to the exposure of sensitive personal details.

Despite the seriousness of the breach, Qantas has assured its customers that certain highly sensitive information, such as credit card numbers, financial details, passport information, and critical login credentials like passwords and PINs, were not compromised in the attack. The airline further emphasized that frequent flyer accounts, which often contain valuable travel and loyalty points, remained secure and were not impacted by the leak.

However, the breach still resulted in the exposure of a substantial amount of personal information. The data that was leaked primarily includes customer names, email addresses, frequent flyer details, birthdates, gender, and contact numbers. Additionally, the personal addresses of both business and home locations were also affected. While these types of data are often considered less sensitive than financial or identification details, they still pose privacy risks, especially when exposed to malicious actors.

To mitigate the spread of the leaked data, Qantas has taken legal steps by seeking an injunction in the Supreme Court. The court granted an order to prevent the stolen data from being published or disseminated further. Despite this legal action, experts remain concerned that the airline’s ability to control the data’s distribution is limited once it enters the hands of cybercriminals. The dark web is likely to be a major platform where this information may circulate, putting the affected customers at further risk.

This data breach is not an isolated incident involving Qantas alone. The attack on the airline is part of a larger wave of cyber incidents targeting businesses that rely on Salesforce as a third-party service for storing and managing customer data. Salesforce is a major platform used by many global companies to handle sensitive customer information. Along with Qantas, other well-known companies have also been impacted by similar breaches. Major corporations such as Disney, Ikea, Google, Air France, and KLM have all reported incidents where customer data stored on Salesforce’s platform was accessed and leaked.

For Qantas customers, the breach raises serious questions about the security of their personal information, even when it is stored with trusted, third-party platforms like Salesforce. While the airline has worked to assure customers that their financial details and sensitive credentials are safe, the leak of names, contact details, and frequent flyer information still represents a significant privacy violation. Those affected may now face the risk of identity theft, phishing attacks, and other malicious activities by cybercriminals using the stolen data.

As part of the ongoing investigation into the breach, Qantas has promised to provide more updates and guidance for affected customers. The airline has committed to monitoring the situation closely and is working with cybersecurity experts to understand the full scope of the attack. Furthermore, Qantas has advised customers to remain vigilant for any suspicious activity related to their personal details, including unsolicited emails, phone calls, or messages asking for sensitive information.

The Salesforce breach highlights the increasing risks businesses face when entrusting third-party platforms with sensitive customer data. As the digital landscape becomes more interconnected, companies are facing mounting pressure to implement robust cybersecurity measures to protect against data breaches. This incident underscores the importance of ensuring that all parties involved in the handling and storage of personal data are held to the highest standards of security.

As the investigation continues, the full impact of this breach remains unclear. However, it serves as a harsh reminder of the vulnerabilities inherent in modern digital ecosystems, where multiple third-party services handle and store consumer information. The evolving nature of cybercrime and the growing sophistication of cybercriminals make it even more important for both businesses and consumers to remain proactive about data security. For affected Qantas customers, the long-term effects of this breach are yet to be fully realized, but the event undoubtedly marks a turning point in how both airlines and other industries handle customer data going forward.