AU: Regulator’s preliminary findings did not indicate Qantas breached privacy obligations

The report describes a 2025 breach of Qantas customer data in which attackers socially engineered a contractor employee to open a CRM session, enabling exfiltration of 5.67 million records later released by criminals; the Australian regulator’s preliminary inquiry did not find a likely privacy law breach, noted existing controls and a problematic default CRM setting (now changed), and a NSW Supreme Court injunction limits distribution of the stolen data.