Last week, Qantas announced that it had identified a data breach at one of its contact centres. Since then, it has been investigating the breach to better understand the customer data that had been affected.
This week, Qantas has given a further update on the situation. In addition, they have begun the task of emailing specific details to each affected customer.
Details on Customers Affected
Initially, Qantas had thought that about six million customers were affected by the breach. They have revised this number to 5.7 million customers, based on removing some duplicated from their counts. While I am not sure what that 5.7 million represents, it is quite likely it represents the majority of active members of the program.
Information Accessed
Qantas has divided the overall number into three cohorts. Within each of these groups, different information is on the affected system.
- 1.2 Million Members – Customer records were the names and email addresses of members
- 2.8 Million Members – Customer records includes names, email addresses, Qantas Frequent Flyer number, and Status Tier. Some in this group also had points balance and status credit information.
- 1.7 Million Members – Customer records contained the above and some or all of the following:
- Residential and/or business addresses (1.3 million customers). In some cases, this has included hotel addresses for misplaced baggage delivery.
- Dates of birth (1.1 million customers)
- Phone numbers (900,000 customers) – Mobile, Landline or Business numbers
- Genders (400,000 customers) – This is separate to other gender identifiers like name and salutation.
- Meal preferences (10,000 customers)
Advising Customers
Qantas has begun to advising affected customers of their specific details. This process began on Wednesday morning, but Qantas expects that it will take 24-48 hours to advise all 5.7 million affected members.
According to Qantas Chief Executive Office, Vanessa Hudson
Our absolute focus since the incident has been to understand what data has been compromised for each of the 5.7 million impacted customers and to share this with them as soon as possible.
From today we are reaching out to customers to notify them of the specific personal data fields that were held in the compromised system and offer advice on how they can access the necessary support services.
Since the incident, we have put in place a number of additional cyber security measures to further protect our customers data, and are continuing to review what happened.
Advice
At this point, Qantas is saying that accounts are secure. However, given the incident has taken place has given the following advice:
- Remain alert, especially with email, text messages or telephone calls, particularly where the sender or caller purports to be from Qantas. Always independently verify the identity of the caller by contacting them on a number available through official channels;
- Where available, use two-step authentication – such as an authentication application – for personal email accounts and other online accounts;
- Stay informed on the latest threats by visiting the Australian Cyber Security Centre and the National Anti-Scam Centre’s Scamwatch webpage;
- Visit IDCARE’s Learning Centre and the Office of the Australian Information Commissioner website for further information and resources on protecting personal information; and
- Do not provide your online account passwords, or any personal or financial information. Qantas will never contact customers requesting passwords, booking reference details or sensitive login information.
Customers can continue to access the dedicated support line on 1800 971 541 or +61 2 8028 0534. This service remains available 24/7 and customers have access to specialist identity protection advice and resources through this team.
