# Qantas: 5.7M customers' data stolen from a contact-centre platform · pwn.watch

> A cyber criminal accessed a third-party customer-service platform used by a Qantas contact centre. After deduplication, 5.7M unique customers were affected: names, emails, frequent-flyer details, and for some phone numbers, birth dates, addresses, gender and meal preferences. No passwords, PINs, card or passport data were taken.

Page: https://pwn.watch/i/qantas-contact-centre-breach-july-2025 · generated 2026-10-22T22:54:30.229Z

## Status
- Severity: high · status: closed · patch: no-fix-needed
- Product: Qantas contact-centre (third-party platform)
- Started: 2025-06-30 · closed: 2025-07-09
- Affected: n/a

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/qantas-contact-centre-breach-july-2025/feed.xml
- JSON Feed: https://pwn.watch/i/qantas-contact-centre-breach-july-2025/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/qantas-contact-centre-breach-july-2025.json
- This file: https://pwn.watch/i/qantas-contact-centre-breach-july-2025/llms.txt

## Updates (newest first)
- 2025-07-09: Qantas update: 5.7M unique customers affected (https://www.qantasnewsroom.com.au/media-releases/update-on-qantas-cyber-incident-wednesday-9-july-2025/)
- 2025-07-02: Qantas discloses the cyber incident (initially 6M records) (https://www.qantasnewsroom.com.au/media-releases/qantas-cyber-incident/)

## Fix brief
# Security brief: Qantas: 5.7M customers' data stolen from a contact-centre platform

Source: https://pwn.watch/i/qantas-contact-centre-breach-july-2025 · status: closed (closed Jul 9, 2025) · severity: high · updated Jul 9, 2025

## Patch status
**NO FIX NEEDED: no action on your side beyond verification.**

## What it is
A cyber criminal accessed a third-party customer-service platform used by a Qantas contact centre. After deduplication, 5.7M unique customers were affected: names, emails, frequent-flyer details, and for some phone numbers, birth dates, addresses, gender and meal preferences. No passwords, PINs, card or passport data were taken.

Severity detail: Data breach of 5.7M customers

- Product: Qantas contact-centre (third-party platform)

## Affected versions
- n/a

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
No fixed version is listed. Follow the vendor advisory below.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Latest updates
- Jul 9, 2025: Qantas update: 5.7M unique customers affected
- Jul 2, 2025: Qantas discloses the cyber incident (initially 6M records)

## Advisories
- [QANTAS CYBER INCIDENT](https://www.qantasnewsroom.com.au/media-releases/qantas-cyber-incident/) (Qantas)
- [Update on Qantas cyber incident: Wednesday 9 July 2025](https://www.qantasnewsroom.com.au/media-releases/update-on-qantas-cyber-incident-wednesday-9-july-2025/) (Qantas)

## Write-ups & news
- [Qantas hit by cyber attack, leaving 6 million customer records at risk](https://www.abc.net.au/news/2025-07-02/qantas-cyber-attack-significant-data-stolen/105484720)

## Caveats
startedAt (Jun 30) is the detection date reported by Qantas, from memory; disclosure was Jul 2.

---
Machine-readable: https://pwn.watch/i/qantas-contact-centre-breach-july-2025.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.