Qantas Suffers Major Data Breach Affecting Up to 6 Million Customers Qantas, Australia’s largest airline, has confirmed a cyberattack that compromised the personal data of up to six million customers through a third-party call center platform. The breach was detected on Monday, with threat actors gaining unauthorized access to customer service records. The stolen data may include names, email addresses, phone numbers, birth dates, and frequent flyer numbers. Qantas has assured customers that no financial information, credit card details, or login credentials were exposed. The airline has contained the incident, stating that its internal systems remain secure, and has set up a dedicated support line for affected individuals. Qantas Group CEO Vanessa Hudson apologized, emphasizing the company’s commitment to customer trust and support. The breach follows a series of controversies for the airline, including pandemic-related operational issues and opposition to Qatar Airways’ expansion plans. Authorities, including the Australian Cyber Security Centre, the Office of the Australian Information Commissioner, and the Australian Federal Police, have been notified. Independent cybersecurity experts are investigating the incident. Potential Link to Scattered Spider While the attackers’ identity remains unconfirmed, the tactics used align with those of the Scattered Spider ransomware group, which has recently targeted airlines and retailers in the U.S. and U.K. The FBI has warned about the group’s use of social engineering such as phishing, SIM swapping, and help desk impersonation to bypass multi-factor authentication and steal sensitive data. Scattered Spider, also known as UNC3944, is a sophisticated cybercriminal collective believed to consist of young adults in the U.S. and U.K. The group has been linked to high-profile attacks on MGM Resorts, Caesars Entertainment, and Snowflake customers, often partnering with ransomware-as-a-service (RaaS) providers like ALPHV. Their recent focus on aviation includes breaches at Hawaiian Airlines and WestJet, where they exploited self-service password reset tools. Rising Cyber Threats in Australia The Qantas breach adds to a surge in cyber incidents across Australia. The Office of the Australian Information Commissioner reported a 25% year-on-year increase in data breaches, with 1,113 incidents in the last fiscal year up from 893 in 2023. The health sector was the most targeted, followed by government, finance, and retail. 69% of breaches were attributed to malicious or criminal activity, with phishing and ransomware as the primary methods. Scattered Spider’s evolution from telecom attacks to critical infrastructure and high-profile extortion highlights the growing sophistication of cybercriminal groups. Their use of legitimate remote-access tools and cloud platforms underscores the challenges organizations face in defending against such threats.

Airlines Hit by Cyber Attacks Ahead of Holiday Travel Surge Multiple airlines including Hawaiian Airlines, WestJet, and Qantas reported cyber attacks on their IT systems in the days leading up to the Fourth of July holiday travel rush. The FBI has attributed the incidents to Scattered Spider, a hacking group known for using social engineering and third-party vendor exploits to breach large organizations. Hawaiian Airlines and WestJet confirmed attacks within the past week, with the Federal Aviation Administration (FAA) stating on June 26 that the Hawaiian Airlines breach had no impact on flight safety. WestJet launched an internal investigation, while Qantas disclosed a separate attack on June 25, revealing that a third-party customer service platform was compromised before the breach was contained. The FBI issued a warning on June 28, identifying Scattered Spider as the likely culprit behind the airline sector targeting. Airlines are responding by collaborating with authorities, strengthening cybersecurity measures, and notifying affected customers as investigations continue. The attacks highlight growing cyber risks in the travel industry, particularly as reliance on third-party vendors increases. While no operational disruptions or safety issues have been reported, the incidents underscore the need for heightened security in an increasingly digital travel ecosystem.

Cybercriminal Group Scattered Spider Targets North American Airlines in Recent Attacks At least two major North American airlines WestJet and Hawaiian Airlines have confirmed cyberattacks in June, as the FBI and cybersecurity firms warn of a surge in threats against the aviation industry. The attacks have been linked to Scattered Spider, a notorious cybercriminal group known for its social engineering tactics and ransomware deployments. WestJet first detected the breach on June 13, stating it had made "significant progress" in resolving the incident, though details on operational disruptions remain unclear. Hawaiian Airlines disclosed in an SEC filing on June 17 that it had identified a hack but confirmed flights were operating normally. Meanwhile, American Airlines reported a separate "technology issue" on June 21, though it has not confirmed whether the incident was cyber-related. Scattered Spider, described by cybersecurity firms as a loosely organized group of young, English-speaking hackers, specializes in phishing and social engineering to gain access to corporate systems. Once inside, they often hand off control to ransomware operators, who lock critical systems and demand payment. The group has previously targeted Las Vegas casinos in 2023 and British retailers earlier this year, causing widespread disruptions, including supply chain shortages for Whole Foods. The FBI issued a public warning on June 21, stating that Scattered Spider was actively targeting aviation and that the agency was collaborating with industry partners to mitigate the threat. Google’s Mandiant and Palo Alto Networks have also observed the group’s recent focus on the sector, with Mandiant’s CTO, Charles Carmakal, noting multiple incidents in transportation and aviation. While both WestJet and Hawaiian Airlines have assured that flights remain unaffected, the full scope of the breaches including potential data exposure remains under investigation. The attacks underscore the aviation industry’s growing vulnerability to sophisticated cyber threats.

Hawaiian Airlines experienced a cyberattack that took down some of its IT systems, although it managed to operate a full flight schedule. The attack was attributed to the cybercriminal group Scattered Spider. The Federal Aviation Administration assisted to ensure flight safety. The attack caused intermittent interruptions and errors on the airline's website and app, which were largely restored after five days. Hawaiian Airlines runs 150 flights each day and reported $869 million of revenue in its last quarter as an independent company.