Qantas data breach exposes systemic weaknesses in third-party access controls

Qantas has confirmed a significant cyber breach impacting the personal information of up to six million customers. The compromise occurred via a third-party call centre platform, where cybercriminals exploited inadequate access controls. Early investigations suggest the attack relied on impersonation techniques to bypass security measures, enabling unauthorised access to names, email addresses, phone numbers, and dates of birth. Passport and payment information were not affected.

The breach, discovered on 30 June, underscores the increasing prevalence of supply chain vulnerabilities in high-profile cyber attacks. Qantas has begun contacting affected customers and set up a dedicated support line while cautioning users to be vigilant against phishing attempts.

The rise of social engineering and supply chain exploitation

According to cybersecurity analysts, this attack bears the hallmarks of Scattered Spider, a cybercriminal group known for its advanced social engineering tactics and preference for targeting support channels and third-party services. Over the last 12 months, Scattered Spider has been linked to high-impact breaches at global firms, leveraging impersonation, call spoofing and credential harvesting as primary entry vectors.

These incidents reflect a wider industry pattern. As direct perimeter defences strengthen, attackers are shifting their focus to third-party platforms where identity verification processes are weaker and security standards are inconsistent. Call centres, outsourced IT desks, and SaaS (Software as a Service) platforms are particularly vulnerable to these tactics.

Why do these attacks keep happening

Airlines and other large-scale consumer businesses remain attractive targets due to their vast troves of customer data and complex digital ecosystems. The challenge lies not only in protecting their core infrastructure but also in extending that security posture across a sprawling vendor and partner network.

Attackers know this, and they exploit the weakest link in the chain. In the Qantas breach, that link was a third-party service provider with insufficient access control policies. Weak identity verification and poor session monitoring allowed threat actors to impersonate legitimate users, likely through information collected from previous leaks or credential stuffing attacks.

Australia's Cyber Security Minister recently cited the Qantas incident as part of a broader need for regulatory overhaul following other high-profile breaches, including those at Medibank and Optus. These incidents have prompted Australia to accelerate legislative reform, demanding stronger compliance frameworks and greater accountability for supply chain security.

Implications for UK businesses

While this breach took place in Australia, the underlying vulnerabilities are universal. UK organisations, particularly those managing customer data at scale, must assess the maturity of their vendor risk management. Outsourced functions, especially in customer support, need to be scrutinised with the same rigour as internal operations.

Identity and access management (IAM) must now extend beyond organisational borders. Least-privilege access, session monitoring, continuous authentication, and stronger multi-factor authentication (MFA) for third-party users should be non-negotiable.

Cyber resilience is no longer solely about technical tooling. Cultural and procedural gaps, such as staff susceptibility to impersonation or inconsistent onboarding controls for vendors, are just as critical. The persistent threat from groups like Scattered Spider should be a wake-up call for executive teams: the business impact of these breaches goes far beyond technical recovery, often triggering regulatory scrutiny, reputational damage, and customer distrust.

The way forward

Qantas has pledged to improve its third-party access protocols, but the incident exposes a broader need for collective action. Businesses must treat third-party access with the same level of scrutiny as internal access. Periodic reviews, breach simulations and third-party audits should be part of any serious cybersecurity programme.

The fact that no financial data was accessed in this breach is a small consolation. For many attackers, identity data is just as valuable. Used in the right combination, names, birth dates, and contact information enable further fraud, impersonation and targeted phishing attacks. The long-term risk for affected individuals and the reputational toll for businesses cannot be underestimated.

As cybercriminal groups grow more organised and state-adjacent, attacks will become more persistent and precise. Defence strategies must evolve accordingly, with a focus on securing not just systems, but identities, workflows and human behaviour, both in-house and across the supply chain.

Speak to an expert about securing your business from supply-chain security to threat remediation and response.