-optimized.jpg){kind=avatar}
An Australian watchdog isn’t taking action against the airline Qantas over a 2025 data breach; which affected about 5.12 million Australians after a phone-based social engineering attack on an overseas third-party provider contracted by the Australian airline. The Australian Privacy Commissioner has published a report of its preliminary inquiries.
Australian Privacy Commissioner Carly Kind said: โWhile I recognise the serious implications of data breaches such as this one on the lives of the Australian community, in this instance I do not consider that the evidence supports the likelihood that a breach of privacy law occurred. As a result, it would not be appropriate for the OAIC- a proportionate and risk-based regulator – to commence a full investigation or take further action at this stage.”
The watchdog found that Qantas undertook preventative measures such as auditing its overseas third-party contract centre provider, ensuring cyber and data protection training for contact centre agents and setting processes for the destruction and de-identification of personal information once no longer required. During and after the incident, the airline took steps to reduce the impact of the breach.ย ย The data breach occurred despite security measures the airline had in place to reduce the risk of a cyber attack.
โData breaches are a persistent feature of todayโs digital world, and can occur despite organisations taking steps to protect personal information,โ Kind said. โAgentic and advanced AI will only increase the cyber-security risks that businesses face, and it is critical that all organisations continuously review and enhance their security to protect against this growing threat.โ
Comment
Dr Ilia Kolochenko,ย founder of a cybersecurity companyย ImmuniWeb,said: โFrom the legal viewpoint, the liability of impersonated company is largely uncertain, jurisdiction specific, and is deeply intertwined with the facts and security measures implemented by the victimized company. From the technical viewpoint, preventive monitoring, customer education and ongoing awareness campaigns can greatly help to reduce the impact of AI-powered fraud.
“In 2026, we will probably see another surge of AI-propelled fraud. Indeed, the next 18 months are poised to bring record revenues to cybercriminals and gigantic losses to businesses and consumers. While human error remains among the most prevalent root causes of security incidents, the attackers, even the technically unskilled ones, now have access to powerful LLM models that can artfully deceive and impersonate by text, voice, images and even video.
“The problem is that while Western AI companies continually harden and improve the guardrails to prevent their AI models from misbehaving or giving harmful advice, most other AI vendors do not care and release AI models without any guardrails into the wild. Resultingly, scammers and fraudsters can easily impersonate anyone or anything. Even experienced cybersecurity professionals fall victim to synthetic content when the latter combines psychological tricks that modern AI masters pretty well. This is why strict regulation of AI in the EU or US will unlikely bring major results: cybercriminals will simply shift to foreign and open-sourced AI models.”
About the breach
As set out by the watchdog, on a Saturday in June 2025, an agent employed at a contact centre received a call from a threat actor impersonating โQantas IT helpโ. The agent was deceived into believing that the threat actor was a legitimate Qantas employee that was contacting to check an IT issue that the Agent may have been experiencing. The threat actor directed the agent to visit a website related to a customer relationship management platform used by Qantas contact centre agents. The threat actor directed the agent through a series of actions that the threat actor claimed were required to close an IT support ticket. At the time, the agent was authorised to access the contact profiles of customers on the platform as part of performing their daily role. The actions resulted in the agentโs instance of the CRM platform being connected to a data extraction tool operated by the threat actor, which was used to extract data from the contact profiles that the agent had access to.
