Qantas has confirmed that a serious cyber incident may have exposed the
personal details of up to six million customers, following a breach of a
third-party contact centre platform. The national carrier said it
detected “unusual activity” on Monday involving one of its offshore
service platforms, which is operated by a call centre based in Manila.
The airline said the breach has now been contained.
One of Australia's legal firms has taken Qantas to task over a massive
data breach that has left millions of customers' private information in
the hands of criminals who are also targeting Telstra.
A legal firm is investigating a potential class action against Qantas after hackers threatened to release private data from their customer database.
Names, numbers, emails, addresses, birthdays and frequent flyer numbers from 5.7 million Qantas customers are at risk of being publicised, unless software company Salesforce pays a ransom by Friday.
The hacker group, Scattered Lapsus$ Hunters, also claims to have the details of Telstra customers.
In an update on its ransom site on Thursday, the group threatened to leak 100GB of Telstra customers’ personal information.
Maurice Blackburn lawyers, Australia’s leading class actions law firm, has filed a complaint to the Office of the Australian Information Commissioner (AIC) against the airline for a breach of privacy.
If you have been impacted, here’s how you can get involved.
HOW DO I KNOW IF I’M AFFECTED?
Customers have been affected differently, but if you have been a Qantas passenger you may be at risk.
By
now, all impacted customers should have received an email titled
“confirmation of your details impacted by the cyber incident.”
The
email explains exactly which of your details were accessed by the
hacker and flags an update to the Qantas Frequent Flyer platform which
will be available soon and allow customers to see the “types of data
held on the compromised system.”
“Our customer records are based
on unique email addresses, so if you have multiple email addresses
registered with Qantas, you may have received a separate notification to
different impacted email addresses,” Qantas said.
Make sure to check your spam or junk folder.
WHAT IS MAURICE BLACKBURN’S COMPLAINT ABOUT?
The
data breach representative complaint have been made against Qantas
because they claim the airline has breached the Privacy Act 1988.
This is a law the protects how personal data is handled by the government and by many private organisations.
Maurice Blackburn alleges that Qantas failed to adequately protect the personal information of its customers.
Complaining through a representative can allow a large number of the same complaint to be processed at the same time.
WHAT PERSONAL DATA WAS STOLEN?
A wide range of personal data was accessed by the hacker.
For four million customers, the data accessed is limited to their name, email address and Qantas Frequent Flyer details.
Of
these four million, 1.2 million customers only had their name and email
address accessed by the hacker and the remaining 2.8 million also had
their Qantas Frequent Flyer number accessed.
Most of the customers
whose frequent flyer number was accessed also had their tier and, in a
lesser umber of cases, their points balance and status credits.
However for 1.7 million customers, the data hack was more substantial.
Of
these customers, 1.3 million had their address revealed to the hacker –
this includes business addresses and also the addresses of hotels
customers may have stayed in which Qantas had records of for the purpose
of reuniting them with misplaced baggage.
Around 1.1 million people had their date of birth accessed.
Approximately
900,000 customers had their phone numbers accessed, 400,000 had their
gender revealed to the hacker and 10,000 the meal preferences they chose
on flights.
No financial data was breached.
WHO CAN PARTICIPATE IN THE COMPLAINT?
If you have been notified by Qantas that your information is at risk, then you’re able to participate.
This includes former and current customers.
It
doesn't cost any more upfront and if there is a successful outcome, the
cost of the service paid to Maurice Blackburn for their legal service
will be deducted by the payment affected customers are entitled to.
If it’s unsuccessful no money is owed to Maurice Blackburn.
HOW DO I PARTICIPATE?
For those keen to get involved in the
class action, you need your name, number, email and address to register
with Maurice Blackburn.
Even if you’ve already interested your
interest with another law firm you can register with Maurice Blackburn
to get updates about their investigation into potential compensation.
To sign up, you can to the Register now page on the Maurice Blackburn Lawyers site under Qantas Data Breach in the Join a class action section.
Alternatively, you can get in touch with the lawyers using qantasdatabreach@mauriceblackburn.com.au
QANTAS WAS CONTACTED BY THE HACKER – WHAT’S THE LATEST?
The
bad actor responsible for the hack has contacted Qantas who have
refused to comment further given the active criminal investigation.
Precedence,
including the Optus and Medibank incidents, suggest it is unlikely
Qantas will cave and pay the ransom demand of the hacker which have not
been made public but could be in the many millions of dollars.
The hacker dated the potential release of the information as October 10.
ARE CUSTOMERS VULNERABLE TO SCAMS NOW?
Qantas has recommended
customers take precautionary steps and maintain an increased level of
vigilance in the wake of the cyber attack.
“Remain alert,
especially through email, text messages or telephone calls, particularly
where the sender or caller purports to be from Qantas,” an email to
impacted customers reads. “Always independently verify the identity of
the caller by contacting them on a number available through official
channels.
“Do not provide your online account passwords, or any
personal or financial information. “Qantas will never contact customers
requesting passwords, booking reference details or sensitive login
information.”
Source:supplied.
