Tech support scam caused massive data breach at Australian airline Qantas

A tech-support vishing attack on a Qantas contact-center agent in 2025 enabled attackers to link the airline's CRM to a data-extraction tool and siphon PII for approximately 5.7 million customers. The Australian Privacy Commissioner concluded Qantas had taken reasonable privacy and security measures (audits, training, role-based access) and did not open a formal investigation, though legal action and further scrutiny may continue; attribution remains unconfirmed with reports speculating Scattered Spider involvement.