Qantas Cyber Breach: Unmasking Vulnerabilities in Aviation Security

Qantas Cyber Breach: Unmasking Vulnerabilities in Aviation Security

• Qantas confirmed a cyber incident on July 2, 2025, at one of its airline contact centres.
• The attacker got in through a third-party platform used by the call centre. It held service records for 6 million customers.
• Groups targeting airlines had already prompted warnings to the industry from the FBI.
• Cybersecurity measures for airlines are getting a fresh look, especially around call centres and outside vendors.

What Qantas disclosed

Qantas said a cyber criminal targeted one of its call centres and gained access to a third-party customer servicing platform. The airline spotted unusual activity on Monday, June 30, 2025. It contained the system and warned that a large share of the data had probably been stolen. An initial review found customers’ names and contact details, along with birth dates and frequent flyer numbers. Card details and passport numbers were never held on the platform. Qantas said no frequent flyer accounts were compromised, and no passwords or PINs were taken. The airline also said there was no impact on its operations or on safety.

The weak point: call centres and vendors

The breach shows how much airline data sits outside the airline’s own systems. Carriers depend on airports and booking platforms, and on outsourced service providers. Any one of them can be the way in. In this case it was a customer service platform run by a third party, reached by targeting the people who staff the phones.

Organized groups going after airlines

The timing matters. Days before the Qantas disclosure, the FBI had warned that a hacking group was targeting the airline sector, using social engineering against help desks and call centres to get into corporate systems. Qantas did not name an attacker in its statement. The pattern points to a sustained campaign against aviation, with customer data as the prize.

What airlines can tighten now

The practical lessons are specific. Train call-centre and help-desk staff to verify callers before resetting access or granting permissions. Review what customer data outside vendors can reach, and cut it back where possible. Test those vendor connections the way you test your own network, and keep monitoring tuned to catch unusual bulk exports quickly.

Regulators and reporting

Qantas notified the Australian Cyber Security Centre and the Office of the Australian Information Commissioner, and it brought in the Australian Federal Police given the criminal nature of the attack. Aviation regulators can push the industry further by setting clear security standards for airlines and their suppliers and checking compliance through regular audits.

What Qantas customers should watch for

The immediate risk for affected customers is targeted scams. Someone who has your birth date and frequent flyer number can write a very convincing email or make a convincing phone call. Treat unexpected messages about your Qantas account with suspicion and contact the airline through its official channels.

For the wider industry, the incident is a reminder to look past the airline’s own perimeter. Contact centres and the vendors behind them hold the same customer data as the core systems, and attackers have noticed.

Fred Templeton, CISA, CASP, SEC+

Fred Templeton is a practicing Information Systems Auditor in the Washington DC area. Fred works as a government contractor and uses his skills in cyber security to make our country's information systems safer from cyber threats. Fred holds a master's degree in cybersecurity and is currently working on his PHD in Information Systems.