Qantas — Third-party compromise discovered June 2025

Update to a previously disclosed incident
Third-party compromise
Verified from an official regulator or organisation notice

What this record states

Qantas has reported a data breach through a platform operated by a third party.

The source states that information about customers and Frequent Flyer accounts was involved, across 11 categories of personal information.

Qantas identified the incident on 30 June 2025.

No source consulted for this record states when the incident occurred and when it was first publicly disclosed.

The number of people affected has not been stated.

Record overview

Incident date: Not confirmed
Discovery date: 30 June 2025
Disclosure date: Not confirmed
Notification date: Not confirmed
People affected: Not stated
Who was affected: customers and Frequent Flyer accounts

Each date is either established by a quoted source or explicitly not confirmed.

Affected people and data

Notifications and response

Regulators notified

National Cyber Security Coordinator
Australian Cyber Security Centre
Office of the Australian Information Commissioner

Law enforcement notified

Australian Federal Police

Legal and formal response

interim injunction in the NSW Supreme Court

Technical and organisational remediation

further restrict access
strengthen system monitoring and detection
requiring additional identification for account changes

Official sources

Official notice

Information for customers on cyber incident | Qantas AU

qantas.comRetrieved 5 August 2026

View official source

Further official sources

Regulatory update

Privacy Commissioner completes preliminary inquiries into Qantas 2025 data incident | OAIC

oaic.gov.auRetrieved 6 August 2026

View official source

Cleverer commentary

This section is commentary by Cleverer, not reporting, and is not drawn from the sources cited above.

Cleverer Insight

The Qantas notice clearly states when unusual activity was detected, but it does not establish when the incident itself began or the exact date it was first publicly disclosed.

That distinction matters because breach timelines are often repeated as fact even when the original source supports only a detection date. Maintaining clear separation between incident, discovery, notification and disclosure dates helps organisations produce more accurate records and avoid overstating what is known.

How Cleverer may have helped

Where suppliers or third-party platforms can access customer information, Cleverer may help an organisation maintain current evidence of supplier access controls, identity verification, monitoring, incident responsibilities and periodic review activity.

This would not mean the incident was necessarily preventable. It could, however, make control gaps easier to identify before an event and provide clearer evidence during incident response, regulatory review and follow-up remediation.