Loading story…
Qantas disclosed that a cyberattack exposed personal data belonging to about 5.7 million to 6 million customers, making it one of the most significant airline-sector breaches reported in Australia. Early reporting said the incident affected customer records rather than flight operations, with exposed information understood to include personal and contact details held in airline systems. Coverage also linked the intrusion to the broader wave of attacks against airlines and travel firms attributed to Scattered Spider, a financially motivated threat group known for social-engineering tactics and extortion.
Subsequent reporting said Qantas was among nearly 40 companies facing ransom demands from the same hacker group, and that attackers later leaked data containing roughly 5 million customer records after a ransom deadline passed. The leak escalated the incident from a large-scale breach to a public extortion event, increasing the risk of fraud, phishing, and identity abuse for affected customers while underscoring the aviation sector's exposure to coordinated intrusion-and-ransom campaigns.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
After a ransom deadline expired, hackers leaked data containing 5 million Qantas customer records. The publication of stolen data represented a major escalation in the incident's impact.
Later reporting said Qantas was one of almost 40 companies targeted with ransom demands by the hacker group behind the campaign. This marked an escalation from data theft to extortion pressure.
Qantas updated its breach disclosure, saying the cyberattack affected 5.7 million customers. This refined the scope of the incident from the roughly 6 million initially reported.
Coverage of the Qantas incident identified Scattered Spider as the hacker group believed to be targeting airlines, adding attribution context to the breach. The reporting described the group as part of a broader campaign against the aviation sector.
Qantas disclosed that attackers accessed a third-party platform used by one of its contact centres and stole customer data. Early reporting said the breach affected about 6 million airline customers.
5 references tracked. Mallory keeps watching after this page renders.
theguardian.com
Open sourcetheguardian.com
Open sourcecybersecuritydive.com
Open sourceabc.net.au
Open sourcebbc.co.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A hacking group known as Scattered LAPSUS$ Hunters publicly released data stolen from the Salesforce environments of multiple companies, including Qantas and Vietnam Airlines. The group had previously threatened to leak data unless Salesforce or the affected companies paid a ransom, but the deadline passed without payment, prompting the attackers to publish data from six of the 39 companies they claimed to have compromised. The initial leaks included data from Qantas, Albertsons, GAP, Vietnam Airlines, Fujifilm, and Engie Resources. Qantas received significant media attention due to a court injunction it obtained in an attempt to prevent the use or dissemination of the stolen data, but the injunction proved ineffective as the data was still widely distributed. The attackers used multiple platforms to share the stolen information, including an onion site, a clear net forum, and a new clear net leak site, making the data accessible to a broad audience. For Vietnam Airlines, the breach resulted in the exposure of 7.5 million unique customer email addresses, along with names, phone numbers, dates of birth, and loyalty program membership numbers. The breach of Vietnam Airlines' Salesforce environment reportedly occurred in June 2025, but the data was not publicly released until October. The group’s leak strategy included charging for access to the data on some platforms, while later making it freely available on others. Despite initial claims of a massive leak affecting 39 companies, only six organizations' data was actually released, leading to speculation about the group’s motives and capabilities. The attackers communicated with followers via Telegram, providing updates and alternative download links when their primary leak site experienced technical issues. The incident highlighted the limitations of legal measures such as injunctions in preventing the spread of stolen data once it is in the hands of threat actors. Media and security experts, including Troy Hunt, provided commentary on the situation, emphasizing the inevitability of the data’s release and the challenges faced by affected organizations. The breach underscores the risks associated with third-party cloud platforms like Salesforce and the importance of robust security controls and incident response plans. Companies affected by the breach were advised to notify impacted customers, recommend password changes, and implement additional security measures such as two-factor authentication. The event also demonstrated the evolving tactics of cybercriminal groups in monetizing and publicizing stolen data, as well as the ongoing threat posed by supply chain and third-party breaches.
Jun 29, 2026
Allianz Life and WestJet have both confirmed significant data breaches impacting a combined total of approximately 3.7 million customers and employees across North America. Allianz Life, an insurance company, reported that the personal data of about 1.5 million individuals was compromised following a security incident at an unnamed third-party customer relationship management (CRM) provider. The exposed information includes names, addresses, dates of birth, and Social Security numbers belonging to customers, staff, and financial professionals associated with Allianz. The company notified affected individuals through letters and reported the incident to the Maine Attorney General's Office, emphasizing the breadth of the data accessed. In parallel, Canadian airline WestJet disclosed that a cyberattack in June, allegedly carried out by the Scattered Spider group, resulted in the exposure of data for 1.2 million Americans. The breach affected WestJet’s online services and mobile app, prompting the airline to urge customers and staff to exercise additional caution. The compromised data at WestJet may include names, contact details, reservation information, and documents related to travel, though the airline assured that credit card numbers, CVV codes, and user passwords were not affected. WestJet also stated that the safety and integrity of its operations were never at risk during the incident. Both companies have faced scrutiny over the handling of sensitive personal information and the adequacy of their security measures, particularly in the context of third-party service providers. The incidents highlight the persistent risks associated with supply chain vulnerabilities and the growing trend of attackers targeting service providers to access large volumes of data. Regulatory authorities, such as the FTC and state attorneys general, are closely monitoring these breaches, and affected organizations are under pressure to improve their incident response and notification processes. The breaches underscore the importance of robust third-party risk management and the need for organizations to maintain transparency with customers following security incidents. As the number of large-scale data breaches continues to rise, these cases serve as a reminder of the critical need for comprehensive cybersecurity strategies and proactive defense measures across all sectors.
Jun 29, 2026
Optus suffered a major breach that exposed personal information belonging to about 9.8 million current and former customers, including names, dates of birth, addresses, phone numbers, email addresses, and, for roughly 2.8 million people, passport or driver’s licence numbers. Australian officials publicly disputed Optus’s description of the intrusion as sophisticated, citing claims that an internet-exposed unauthenticated API and weak access controls enabled what the cybersecurity minister called a “basic hack,” while the company maintained a skilled criminal was responsible. The incident triggered investigations by the Australian Federal Police, the information commissioner, and ACMA, and intensified scrutiny of telecom-sector cyber oversight and penalties. A BreachForums user claiming responsibility demanded about **US$1 million** and threatened to publish stolen records in batches before later posting an apology and claiming the data had been deleted, a statement authorities did not verify. The fallout included identity-theft warnings, state support for replacing compromised licences, Optus-funded document replacement and credit monitoring, customer backlash over poor communications, and at least one criminal case involving alleged misuse of the stolen data to blackmail victims. The breach also led to a Deloitte review, court fights over disclosure of that report, customer losses, and a large class action as Australia moved to strengthen information-sharing and cyber laws.
Jun 29, 2026