Another major cyber breach has affected Qantas and other major global companies. As a result, cybersecurity advocates are already warning about possible fraud directed at impacted clients. The breach, linked to Salesforce, started in July. Now, the hacker collective Scattered LAPSUS$ Hunters is threatening to sell the stolen data unless they get a ransom payment.
Matthew Warren, a professor and director at RMIT University’s Centre for Cyber Security, said it was a serious data breach. He cautioned it might trigger a “second wave of scams.” He said that the personal data of thousands of Qantas customers is now compromised. We can be certain that criminals will use this breach to do bad things.
The hackers released their demands, well known now, on Saturday at 3 PM AEDT. They threatened to publicly release the data if Salesforce didn’t pay an undisclosed ransom amount. Salesforce decided against meeting this ransom demand, and it’s unclear what happened to this stolen data.
“Don’t be the next headline, should have paid the ransom.” – Scattered LAPSUS$ Hunters
As Warren explained, that’s a big deal, because the costs of these sorts of breaches can be huge. Particularly since Qantas is one of 40 global companies connected to Salesforce whose data was breached. Second, he hammered home the point that the majority of Qantas customers are Australians, only about a quarter of the world’s population.
In light of the breach, Qantas is moving to proactively protect customers. For all other up to date information, they promise to keep their website continuously updated, and have established a specific Disaster Relief Support Line—open 24/7. The helpline numbers are 1800 971 541 or +61 2 8028 0534.
“With the help of specialist cyber security experts, we are investigating what data was part of the release,” – Qantas
Arash Shaghaghi, a cybersecurity professional, added to this importance, emphasizing the necessity of monitoring your personal accounts. He cautioned that any suspicious behavior should not be overlooked. He noted that inconsistencies between bank and credit card statements are a tip-off to the possibility of fraud. This may be related to their recently disclosed data breach.
“It’s the single most effective defence against stolen data being used for account takeover,” – Arash Shaghaghi
As a precaution, Shaghaghi recommended everyone should remain alert to unsolicited communication that appears to be from Qantas or any other company. He cautioned that bad actors might take advantage of personal information released during the breach. They may pose as trusted third parties to dupe victims into providing sensitive information.
“Expect personalised attacks. Be wary of unsolicited emails, texts or calls claiming to be from Qantas, insurers or ‘compensation teams’,” – Arash Shaghaghi
Warren reiterated these concerns by stating, “Other criminals are going to use that information, pretending to be from Qantas, trying to elicit additional personal information or trying to say ‘We are offering compensation, please share your credit card details so we can transfer.’”
Qantas has further protected customers by introducing a specialist identity protection service. Experts warn that even with these protective measures adopted, the risks are still too great.
In addition to the numerous legal ramifications from the breach, Warren called out the pending financial claims. He recommended that class action lawsuits against Qantas should almost always face likely impossibilities. He indicated that the airline may argue that responsibility for data protection lay with a third party and that the data theft did not occur on Australian soil.
