A Timely Reminder: The Qantas Data Breach and How to Strengthen Your Digital Defences

Understanding the Qantas Data Breach

In a recent incident that made headlines (October 2025), Qantas Airways confirmed that customer data stolen from a third-party provider had been leaked online. Data from approximately 5.7 million customers was stolen during a cyberattack on a third-party provider, and this information has since been leaked online (The Straits Times). 

What’s notable is that this incident is tied to a broader wave of breaches affecting Salesforce-connected platforms. Reports suggest that hackers used “vishing” (voice phishing) techniques to impersonate legitimate staff and trick internal help desk teams. In this case, the hackers did not directly hack Salesforce itself, but instead used social engineering (posing as internal employees) to gain privileged access via call centre IT support systems associated with Salesforce-driven services.

The Qantas breach serves as a timely reminder of the interconnected nature of today’s digital ecosystems—where a single supplier’s vulnerability can have significant downstream consequences. It’s also not an isolated case:

• Latitude Financial and Medibank have both suffered major cyberattacks in recent years, resulting in the compromise of sensitive personal and financial data.
• The Australian National University and Optus have also experienced breaches, highlighting that no sector—education, health, or telecommunications—is immune.

These examples reinforce that data protection isn’t just about your own systems. Every email, network, and third-party connection needs to be secured.

The Qantas breach underscores the importance of proactive cybersecurity - especially for organisations managing sensitive customer data. With cyberattacks becoming increasingly frequent and sophisticated, it’s vital to deploy robust security technologies, educate teams, enforce verification protocols, and maintain oversight of all communication systems.

Tips for Clients & IT Managers

• Map your supply chain. Know which third parties, vendors, and contractors have access to your data or systems. They are potential weak links.
• Require strong vendor security auditing. Include cybersecurity standards (e.g., ISO, SOC 2) in vendor contracts and conduct regular reviews or penetration tests.
• Segment and minimise access. Use least-privilege access: third parties should only have access to what they absolutely need.
• Encrypt data in transit and at rest. Even if attackers access the data, encryption provides an additional layer of protection.
• Deploy email security safeguards. Tools like SPF, DKIM, DMARC, and TLS protect communications from spoofing and interception.
• Monitor and react quickly. Use anomaly detection on traffic, login behaviour, and data flows. If something unusual occurs, respond quickly to contain the damage.
• Have an incident response plan. Be prepared with processes, communication plans, and forensic capabilities to respond swiftly and transparently should an incident occur.
• Train staff and users. Human error remains a top cause of breaches. Periodic phishing simulations and security awareness training reduce risk.

How Cumulo9 and C9 Transact Help Mitigate These Risks

As organisations strive to protect customer data and maintain trust, Cumulo9 provides a platform and security practices that assist both general users and IT teams to stay ahead of threats.

Here’s how C9 Transact (and Cumulo9’s security infrastructure) help:

Unlike traditional CRM and campaign email solutions, C9 Transact does not require a database of contact information, and as a consequence, there is no data to hack and steal.

Combined, these controls offer a layered defence, making it much harder for attackers to sneak in or exploit vulnerabilities. 

Final Thoughts

The Qantas breach is a powerful reminder that data security is as much about people and process as it is about the technology platform.

Download our security whitepaper on avoiding scams and phishing. To learn more about our cybersecurity tools or to ask about C9 Transact, contact our team at cumulo9.com/contact.