Qantas Did Everything “Right” — And Got Breached Anyway. Regulators Say That’s the Point.

A June 2025 vishing/social-engineering attack against an overseas Qantas contact-center agent allowed a threat actor to connect to the agent's CRM session and exfiltrate ~5.67 million customer records; no credit card, passport, or login credentials were exposed, Qantas detected and contained the incident quickly, and the Australian privacy regulator (OAIC) declined to commence enforcement after finding the breach was facilitated by social engineering and a vendor default setting that has since been changed.