Australia’s largest airline, Qantas, has disclosed a significant cyberattack that compromised customer data from 6 million passengers. The breach, detected on Monday, occurred when hackers infiltrated a third-party platform used by the airline’s call center operations.

## What Happened

The attack targeted Qantas’s customer service infrastructure, with cybercriminals gaining unauthorized access to a third-party platform containing extensive customer records. While the airline quickly contained the breach and confirmed that all core Qantas systems remain secure, investigators believe a substantial amount of data was stolen.

The compromised information includes:
– Customer names and email addresses
– Phone numbers and birth dates
– Frequent flyer account numbers

Importantly, no credit card information, financial data, or account passwords were exposed in the breach.

## Response and Investigation

Qantas immediately notified key Australian authorities, including the Cyber Security Centre, the Office of the Australian Information Commissioner, and the Federal Police. The airline is continuing to investigate the full scope of the data theft.

## Connection to Scattered Spider Group

This attack aligns with recent warnings from cybersecurity experts about increased targeting of the aviation industry by a notorious hacking group known as “Scattered Spider.” This group, also tracked under multiple aliases including 0ktapus and UNC3944, specializes in sophisticated social engineering attacks.

### Scattered Spider’s Methods

The group employs various tactics to breach organizations:
– Phishing campaigns and SIM swapping
– Multi-factor authentication bombing
– Impersonating employees through help desk calls
– Exploiting self-service password reset systems

### Recent Aviation Targets

Scattered Spider has recently shifted focus to the aviation sector, with confirmed attacks on:
– Hawaiian Airlines
– WestJet (where hackers exploited password reset vulnerabilities)
– Now potentially Qantas

The group previously targeted major companies including MGM Resorts, Twilio, Coinbase, and Reddit, often partnering with ransomware operations like BlackCat and RansomHub.

## Industry Implications

This breach highlights the growing threat to aviation companies and the need for enhanced cybersecurity measures. Organizations are advised to:
– Implement comprehensive infrastructure monitoring
– Secure self-service platforms and help desk operations
– Review third-party vendor security protocols
– Follow hardening guides released by Google Threat Intelligence and Palo Alto Networks

As Scattered Spider continues its sector-by-sector attack strategy, the aviation industry faces an elevated threat level, with experts uncertain which sector the group will target next.