Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Qantas confirmed in July 2025 that 5.7 million customer records were affected in a breach involving a third-party contact-centre platform. A later report by Australia’s privacy regulator counted approximately 5.67 million compromised records worldwide, including about 5.12 million Australians. If you may be affected, Qantas says it contacted customers with the information categories relevant to them; check its official incident update for your individual notice and current help options.
What happened in the Qantas data breach?
On 30 June 2025, Qantas detected unusual activity on a third-party platform used by an airline contact centre. The Office of the Australian Information Commissioner (OAIC) later described the incident as a social-engineering attack on an overseas provider contracted by Qantas. Qantas said it contained the incident after detecting the activity.
Qantas publicly disclosed the incident on 2 July 2025. Its initial statement said about six million customers had service records on the affected platform, while the company investigated how many records had been stolen. On 9 July, Qantas said 5.7 million records were affected and began notifying customers. The six-million figure referred to the platform’s customer-record population, not the final number of records confirmed compromised.
How many records and people were affected?
The figures describe different things and should not be treated as interchangeable:
#1 Best Overall
- Six million customers: Qantas’s 2 July 2025 estimate of customers with service records on the affected platform.
- 5.7 million records: Qantas’s figure announced on 9 July 2025 for affected records.
- Approximately 5.67 million compromised customer records: the OAIC’s 2026 report count, including overseas customers.
- Approximately 5.12 million Australians: the OAIC’s estimate of people in Australia affected.
A record is not necessarily the same as a person. Qantas said its customer records were based on unique email addresses, so someone with more than one email address could have had multiple records.
What information was exposed?
The information differed by record. Qantas said most compromised records contained some combination of a customer’s name, email address and Frequent Flyer details. The OAIC’s 2026 report says approximately four million records were in this main group, which included names, phone numbers, email addresses and Frequent Flyer information such as membership numbers, tiers, points balances and status credits.
Other records contained additional details. Qantas identified address, date of birth, phone number, gender and meal preferences among the fields that could be present. Not every affected customer had every field exposed; Qantas’s notification is the relevant source for the categories associated with an individual.
Qantas says the breach did not affect Frequent Flyer account access: passwords, PINs and login details were not accessed or compromised. It also says payment-card details, personal financial information and passport details were not held on the affected platform.
Was the data released?
Yes. Qantas’s incident page, updated 12 October 2025, said cyber criminals had released customer data after the July incident. At that point, Qantas said it was investigating which data was included in the release. The update does not establish the precise number of records or the complete set of fields released.
What should affected customers do?
- Check Qantas’s notice. Qantas said it emailed affected customers about the types of information relevant to them. It also provided affected Frequent Flyers a way to view their categories through a logged-in account. Use the Qantas incident page for current individual guidance and support details.
- Be alert for impersonation attempts. Treat unexpected emails, texts or calls claiming to be from Qantas with caution. Verify a caller independently using a phone number obtained from an official channel, rather than relying on details in an unsolicited message.
- Do not disclose secrets to unsolicited contacts. Qantas advises customers not to provide passwords or personal or financial information in response to unsolicited approaches.
- Use two-step authentication where available. Enable it for email and other online accounts that offer it. This is general account-protection advice; Qantas has said passwords, PINs and login details were not compromised in this incident.
Qantas says specialist identity-protection advice and resources are available through its support team. Check the company’s current incident page for the available support routes; contact details and options can change.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What did the privacy regulator conclude?
The OAIC completed preliminary inquiries covering 11 July 2025 to 1 June 2026. It did not commence a commissioner-initiated investigation or take further regulatory action at that stage. The OAIC said its preliminary inquiries did not indicate a likelihood that Qantas failed to take reasonable steps to protect information it held or to ensure its overseas provider complied with the Australian Privacy Principles.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →This was not a final legal finding. The OAIC said it made no concluded findings and that further investigation remains possible. Its report says Qantas responded by analyzing alerts, identifying an unusual unauthorized login, freezing and revoking the account’s access, and assessing possible data exfiltration. It also describes Qantas’s incident-response framework and post-incident remediation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
