Australia’s Qantas Airways announced on Wednesday, July 9, 2025, that a large-scale cyberattack has compromised the personal data of millions of its customers, marking one of the nation’s most severe security breaches in recent memory.
According to the airline, over one million customers had highly sensitive details accessed, including phone numbers, dates of birth, and residential addresses. Additionally, the breach impacted another four million customers whose names and email addresses were taken during the intrusion.
Qantas initially reported the incident last week but has now provided further clarity on the scale of the compromise. After carefully removing duplicate records from the initial estimate of six million, the company determined that the database contained unique personal information belonging to approximately 5.7 million individuals.
Despite the scope of the attack, Qantas said there is currently no evidence suggesting that any of the stolen data has been published or misused. The company emphasized that it has been actively monitoring the situation to detect any suspicious activity or unauthorized attempts to disseminate the compromised information.
In response to the breach, the airline has significantly strengthened its cyber security protocols to protect customer data from further exposure. “Since the incident, we have put in place a number of additional cyber security measures to further protect our customers’ data, and are continuing to review what happened,” Qantas Group CEO Vanessa Hudson said in a statement.
The hack has renewed concerns about the resilience of Australia’s critical infrastructure and large corporate networks, coming just a few years after the country grappled with major cyberattacks on telecommunications provider Optus and health insurer Medibank in 2022. Those incidents prompted the government to implement mandatory cyber resilience laws and stricter reporting requirements for serious breaches.
Cybersecurity analysts have warned that companies holding large volumes of consumer data have become prime targets for sophisticated criminal networks and state-sponsored attackers. The Qantas breach underscores the persistent threats facing organizations across all sectors, particularly airlines and travel companies that process vast amounts of personal and financial information.
Qantas has urged customers to remain vigilant against potential phishing scams or suspicious communications that could emerge as a result of the incident. The airline said it is cooperating closely with cybercrime authorities and regulators to investigate the breach and mitigate any further risks.
The company also encouraged affected customers to update their passwords and enable multi-factor authentication wherever possible to enhance their account security.