What happened
In July 2025 Qantas disclosed that a third-party platform used by one of its contact centres had been accessed by cyber criminals [qantas]. The OAIC’s report puts the affected data at about 5.67 million customer records, relating to about 5.12 million Australians; the OAIC counted records, not individuals [oaic-report-qf]. About 4 million records held names, phone numbers, email addresses and Frequent Flyer details, and about 1.7 million also included one or more of address, date of birth, gender and meal preferences; passwords and PINs were not compromised [oaic-report-qf]. The entry point was a social-engineering (“vishing”) call on 28 June 2025 rather than a system flaw [oaic-report-qf]. Qantas said no credit-card, financial or passport data was in the affected system [qantas].
Qantas obtained an interim injunction in the NSW Supreme Court on 17 July 2025 restraining use of the stolen data [qantas], [itnews-injunction-qf]. In October 2025 Qantas said its data was among that released by cyber criminals [qantas].
Timeline
- 2025-06-28 — Vishing call to the contact centre gave access to the third-party platform [oaic-report-qf].
- 2025-06-30 — Qantas detected the unauthorised access [oaic-report-qf].
- 2025-07-02 — Public disclosure [oaic-report-qf].
- 2025-07-17 — NSW Supreme Court interim injunction obtained [qantas], [itnews-injunction-qf].
- 2025-10 — Qantas said its data was among that released by cyber criminals [qantas].
- 2026-07-16 — OAIC published its report; preliminary inquiries closed with no Commissioner-initiated investigation and no regulatory action [oaic-report-qf], [oaic-findings-qf].
Current status
No regulatory action. The OAIC closed its preliminary inquiries without opening a Commissioner-initiated investigation. It said this finding is not an endorsement of Qantas’s practices and that it could still investigate later [oaic-report-qf]. We have not confirmed the outcome of any separate complaints.
Why it matters
The weak point was a third-party platform and a phone call, not Qantas’s core systems — a lesson in supply-chain and social-engineering risk.