Australian airline Qantas has confirmed that the personal information of 5.7 million customers was compromised after hackers breached a third-party platform used by one of its call centers.
The incident occurred on June 30 and did not impact the company’s operations. None of Qantas’ systems was compromised, the country’s flag carrier said.
On July 7, the company announced that a hacker had made contact, likely for extortion purposes, and that it was working to validate the hacker’s claims.
Right from the start, the airline said the personal information of roughly 6 million customers was stored on the hacked platform, and in a July 9 update it confirmed not only the number of affected individuals, but also the type of information that was compromised.
“After removing duplicate records, our investigation has found that there were 5.7 million unique customers’ data held in the system. Specific data fields vary from customer to customer,” Qantas said.
According to the company, 4 million customer records may have contained names, email addresses, and Qantas Frequent Flyer details. Of these, 1.2 million records only contained names and email addresses.
For the remaining 1.7 million customers, their records contained additional information, including addresses for 1.3 million, dates of birth for 1.1 million, phone numbers for 900,000, gender information for 400,000, and meal preferences for 10.000.
“Customer records are based on unique email addresses and customers with multiple email addresses may have multiple accounts,” the company also said, adding that no credit card details, financial data, or passport details were stored on the hacked platform.
The airline has started emailing the impacted customers to notify them of the types of personal information compromised in the attack. The company says it has no evidence that the compromised information has been released publicly.
“Since the incident, we have put in place a number of additional cyber security measures to further protect our customers’ data, and are continuing to review what happened. We remain in constant contact with the National Cyber Security Coordinator, Australian Cyber Security Centre and the Australian Federal Police,” Qantas Group CEO Vanessa Hudson said.
Related: Nippon Steel Subsidiary Blames Data Breach on Zero-Day Attack
Related: Kelly Benefits Data Breach Impacts 550,000 People
Related: Ahold Delhaize Data Breach Impacts 2.2 Million People
