Qantas confirms personal data of over a million customers leaked in breach

Australia’s Qantas Airways said on Wednesday (July 9, 2025) more than a million customers had their phone number, birth date or home address accessed in one of the country’s biggest cyber breaches in years.

The airline operator said that another four million customers had just their name and email address taken during the hack.

After disclosing a cyberattack last week, Qantas said on Wednesday that the breached database contained unique personal information of 5.7 million customers, after removing duplicate records from the initial 6 million affected.

There is no evidence that any personal data of the customers has been released and the company is actively monitoring the situation, Qantas said in a statement.

“Since the incident, we have put in place a number of additional cyber security measures to further protect our customers’ data, and are continuing to review what happened,” Qantas Group CEO Vanessa Hudson said.

The breach represents Australia’s most high-profile cyber attack since telecommunications giant Optus and health insurer Medibank were hit in 2022, incidents that prompted mandatory cyber resilience laws.