Qantas’s stolen customer data reached the public despite an injunction

A data theft became a public-exposure story for Qantas in October 2025. On 11 October, The Guardian and ABC reported that stolen customer information had been released online after threats against a wider group of companies. Reuters carried Qantas’s acknowledgment the following day. This archive covers the release, not the earlier discovery of the intrusion.

That separation matters because breach timelines are often compressed into one alarming headline. The information had been taken months earlier from a third-party system. Public release created another stage of risk, even though it did not mean the airline had suffered a second intrusion at that moment.

ABC reported confirmation from security researcher Troy Hunt and described Qantas’s response. The Guardian covered the wider extortion campaign and the limits of the exposed information. Reporting distinguished customer contact and loyalty-related information from financial details and account access. We do not reproduce any records or list private individuals affected.

The confirmed badge reflects the documented release and company response. It does not validate every number or claim made by the criminal group, nor does it establish that the Salesforce platform itself had been hacked through a software vulnerability. The difference between compromised access to a customer’s environment and a flaw in the underlying service remains important.

The public-interest question is what support and protection customers can receive after stolen information leaves the original attacker’s control. An injunction or takedown effort does not guarantee that copies disappear, but readers do not need a dump link to understand that problem. All links here lead to news reporting. The verified Reuters X post records the company’s acknowledgment; its captured engagement is not an estimate of the stolen data’s circulation or of how many people viewed the criminal release.