The Qantas breach is part of attacks targeting the aviation sector by threat actors linked to Scattered Spider. These threat actors are skilled at social engineering attacks used to gain initial access to corporate networks, commonly by tricking help desks and support vendors into resetting employees' passwords and MFA. Qantas has confirmed that it is now being extorted by threat actors following a cyberattack that potentially exposed the data for 6 million customers. The group later shifted its focus to insurance companies, and more recently, the aviation and transportation industries, with attacks on WestJet and Hawaiian Airlines linked to the threat actors. Qantas says it is working with cybersecurity experts and the Australian Cyber Security Centre, the Office of the Australian Information Commissioner, and the Australian Federal Police to investigate the attack. Qantas also said it will never ask customers for passwords, ticket confirmation codes, or other sensitive information by phone, text, or email. Qantas is warning customers to be on the lookout for scams and phishing emails that may attempt to use the stolen data to steal further sensitive information. The threat actors behind these attacks first targeted the retail sector in April, with breaches on Marks & Spencer (M&S) and Co-op. "A potential cyber criminal has made contact, and we are currently working to validate this," Qantas shared in an updated statement. Qantas disclosed the attack on July 1st, stating it detected unusual activity in a third-party system used by one of its contact centres the day before. Drawing from Wiz's detections across thousands of organizations, this report reveals 8 key techniques used by cloud-fluent threat actors. Lawrence Abrams Lawrence Abrams is the owner and Editor in Chief of BleepingComputer.com. Lawrence's area of expertise includes Windows, malware removal, and computer forensics. For M&S, the group gained access by impersonating an employee and convincing a service desk vendor to reset passwords and multi-factor authentication (MFA) protections.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Mon, 07 Jul 2025 17:05:13 +0000