Australia's Qantas says 6 million customer accounts exposed in cyber hack

A cyber hacker broke into a database containing the personal information of millions of customers, Qantas said, in Australia's biggest breach in years and a setback for an airline rebuilding trust after a reputational crisis.

The individual targeted a call centre and gained access to a third-party customer service platform containing six million names, email addresses, phone numbers, birth dates and frequent flyer numbers, Qantas said in a statement on Wednesday.

The airline did not specify the location of the call centre or customers whose information was compromised. It said it learnt of the breach after detecting unusual activity on the platform and acted immediately to contain it.

"We are continuing to investigate the proportion of the data that has been stolen, though we expect it will be significant," Qantas said, reporting no impact on operations or safety.

Qantas' share price was down 3.5 per cent in morning trading against a 0.4% gain in the broader market.

The breach is Australia's most high-profile since those of telecommunications network operator Optus and health insurance leader Medibank in 2022 prompted cyber resilience laws including mandatory reporting of compliance and incidents.

It brings unwelcome attention to Qantas which is trying to win public trust after actions during and after the Covid-19 pandemic saw it plunge on airline and brand league tables.

Qantas was found to have illegally sacked thousands of ground workers during the 2020 border closure while collecting government stimulus payments. It also admitted selling thousands of tickets for already-cancelled flights.

The airline drew the ire of opposition politicians who said it lobbied the federal government in 2022 to refuse a request from Qatar Airways to sell more flights. Qantas denied pressuring the government which eventually refused the request - a move the consumer regulator said hurt price competition.

Qantas CEO Vanessa Hudson has improved the airline's public standing since taking office in 2023, reputation measures showed.

"We recognise the uncertainty this will cause," Hudson said of the data breach. "Our customers trust us with their personal information and we take that responsibility seriously."

Qantas said it notified the Australian Cyber Security Centre, the Office of the Australian Information Commissioner and the Australian Federal Police.

ACSC declined to comment. OAIC and AFP were not immediately available for comment.

The airline said the hacker did not access frequent flyer accounts or customer passwords, PIN numbers or log in details.