Qantas call center breach affecting 6 million flyers
SYDNEY, AUSTRALIA — Qantas Airways has confirmed a major data breach affecting up to 6 million customers after hackers infiltrated an outsourced call center in Manila as reported by Australian Frequent Flyer.
The incident, attributed to the notorious Scattered Spider cybercrime group, exposes critical vulnerabilities in third-party customer service operations across the aviation sector. This cybercrime group has also been involved in various cases in different firms and fields.
Third-party call centers emerge as critical security weakness
While financial data and passwords remain secure, the scale of exposed personal information creates significant phishing risks for millions of travelers.
Security experts confirm the attack bears hallmarks of Scattered Spider, known for social engineering attacks on service providers.
“This collective of criminals often target victims via third party service providers, using social engineering and trying to convince victims to initiate password resets. Once successful, they then gain access to systems, syphon data and send out a ransom demand,” said William Wright, Chief Executive Officer (CEO) of Closed Door Security, told Help Net Security.
The incident highlights how airlines‘ cost-saving outsourcing creates security blind spots.
Sophisticated cyberattack on aviation
Recently, the Federal Bureau of Investigation (FBI) had warned of a rise in the number of attacks on airline vendors, and Qantas became the most recent victim of the flee that has gained high-profile publicity.
Qantas has engaged cybersecurity firms and government agencies, implementing additional monitoring while notifying affected customers. Wright reminds that organizations be vigilant and strengthen security controls.
However, as Jordan Avnaim, CISO of Entrust notes, “Defending against these risks requires more than perimeter controls – it demands continuous workforce education, Zero Trust principles, phish-resistant multi-factor authentication and identity verification that can’t be socially engineered.”
Reassessing global airlines call center defense
The breach signals urgent need for improved outsourced customer service operations in terms of staff training, vendor vetting, contractual reforms on security compliance, and technical safeguards.
Qantas flyers who have been impacted are advised to keep track of their accounts, avoid clicking links from unknown senders, and be vigilant for suspicious activity, ensuring all communications occur through official sources.
The incident serves as a wake-up call for global airlines to reassess call center security before regulators force their hand – with customer trust and loyalty program integrity now at stake.
