Qantas Breach: A Phone Call to a Call Centre Agent
No password was guessed and no firewall was broken. A caller pretended to be company IT, and a helpful agent followed the instructions.
By Siddharth ShankarUpdated October 11, 2026Australia's privacy regulator (OAIC) published a report on July 16, 2026 on its preliminary inquiries into the Qantas data breach. About 5.67 million customer records were compromised after a threat actor phoned an agent at an overseas contact centre posing as "Qantas IT help." The OAIC closed its inquiries without regulatory action. See what an exposed email address means.
Your email may already be in a known data breach. Find out in about 30 seconds.
Free · About 30 seconds · No sign-up · Email not stored
Call centres are built to help, and that is exactly what makes them a target. The Qantas case shows how a convincing voice on the phone can open a customer database without any technical attack at all.
What happened
According to the OAIC, access occurred on June 28, 2025, the breach was detected on June 30 and Qantas disclosed it on July 2, 2025. About 5.67 million customer records were compromised, though the foreword refers to approximately 5.12 million Australians.
The OAIC ran preliminary inquiries from July 11, 2025 to June 1, 2026 and published its report on July 16, 2026.
How it worked
A threat actor phoned an agent at an overseas contact centre run by a third-party provider, posing as "Qantas IT help." The steps they guided the agent through connected the agent's customer relationship management (CRM) instance to the attacker's data extraction tool. The OAIC calls this vishing, which is phishing by voice.
The agent was not hacked. The agent was talked into doing the connecting.
What was exposed
About 4 million records held names, phone numbers, email addresses and Frequent Flyer details. About 1.7 million records had more: addresses, dates of birth, gender or meal preferences. Qantas says credit card details, financial information, passport details and passwords or PINs were not compromised.
Even without payment data, that information is useful to scammers. A message that knows a person's name, travel history and Frequent Flyer details can sound very convincing.
How it ended
The OAIC found no information that Qantas failed to take reasonable steps and closed its preliminary inquiries without an investigation or regulatory action. It stresses that its findings are preliminary and not concluded, and that the Commissioner may still investigate later.
For customers, there is no compensation described in the report, and the data cannot be recalled.
A timeline of the case
The sequence was fast. Access occurred on June 28, 2025, Qantas detected the breach two days later on June 30 and disclosed it on July 2. The OAIC began preliminary inquiries on July 11, 2025 and closed them on June 1, 2026, and the report appeared on July 16, 2026.
The speed of disclosure, within days, contrasts with the year of regulatory work that followed.
Do not guess. See which breaches include your email and what leaked.
Free · About 30 seconds · No sign-up · Email not stored
Key facts at a glance
- Records compromised: about 5.67 million
- Access, detection and disclosure: June 28, June 30 and July 2, 2025
- Method: a call to a contact-centre agent posing as IT help
- Data in about 4 million records: names, phone numbers, email addresses and Frequent Flyer details
- Data in about 1.7 million records: addresses, dates of birth, gender or meal preferences
- OAIC outcome: inquiries closed without regulatory action; not concluded findings
Why this case matters
The OAIC's decision does not mean customers were unaffected. It reflects its view on what it could establish at the preliminary stage.
The attack path is the lesson. A third-party contact centre with strong technical controls can still be undone by one persuasive call. Training and verification of internal requests matter as much as software.
What you can do
1Expect airline-themed scams
Treat unexpected messages about flights, points or bookings with caution.
2Check contact claims in the official app
Do not use links or numbers in the message.
3Use a unique email for travel accounts if you can
It limits how far a leak spreads. See what an exposed email address means.
4Review your phone number exposure
What vishing means for ordinary callers
Vishing is simply phishing by phone. The attacker uses a confident voice and a plausible role, such as IT help, to get a person to take an action. The target in this case was an agent, but the same technique is used on customers, who receive calls from a "bank" or "technology support."
The shared defense is a rule that does not depend on judging the caller's tone: use only official channels you initiate yourself.
What the report does not say
The report does not conclude who the attacker was, and we do not name one. For another case where staff were manipulated by a caller, see the Telstra SIM swap checks.
The practical next step is similar for most people. Read up on what each type of breached data means, how to tell a real breach notice from a phishing message and what to do after your email appears in a breach, then review your own accounts. You can also try our free email exposure check.
Sources
- OAIC: Report into preliminary inquiries of Qantas (5.67 million records, vishing, dates, inquiry outcome)
Frequently asked questions
How many Qantas records were compromised?
About 5.67 million customer records, according to the OAIC report.
Were credit cards or passports exposed?
Qantas says credit card details, financial information, passport details and passwords or PINs were not compromised.
How did the attacker get access?
By phoning a contact-centre agent posing as Qantas IT help and guiding the agent through steps that linked the CRM to a data extraction tool.
Was Qantas penalized?
The OAIC closed its preliminary inquiries without an investigation or regulatory action, though the Commissioner may still investigate later.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Change reused and leaked passwords
NordPass flags weak and reused passwords, and its Premium plan alerts you if your details appear in new breaches.
See NordPass →Affiliate link. We may earn a commission at no extra cost to you.
Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.