A Phone Call Cost Qantas 5.7 Million Customer Records
Australia’s Privacy Commissioner has published its findings on the 2025 Qantas data breach, and the cause is a wake-up call for any business with a call centre or helpdesk: it wasn’t a hacked server or a software flaw. A criminal simply phoned a Qantas contact centre agent, claimed to be “Qantas IT support,” and talked the agent through steps that connected the customer database to a data extraction tool. The result was personally identifiable information for 5.7 million customers walking straight out the door.
Qantas wasn’t careless by industry standards. The Commissioner’s report notes the airline had audited its contact centre operator, run regular security-awareness testing, provided mandatory and recurring training on handling personal information, used role-based access controls, and scheduled annual data-removal runs from its CRM. None of it stopped a confident voice on the phone from talking one agent into doing the wrong thing. The Commissioner ultimately found no breach of the Australian Privacy Principles and declined to open a formal investigation – but 5.7 million people still had their data exposed, and class actions are still working through the courts.
For small and medium businesses, the lesson isn’t “buy better software” – it’s that your people are the front line, and impersonation is cheap. A few practical steps:
- Verify before you act. Anyone claiming to be “IT support” on an unsolicited call should be called back on a known internal number before any system access is granted.
- Limit what one login can touch. Role-based access and export controls mean a single tricked staff member can’t hand over your whole customer list.
- Refresh scam-awareness training regularly – not just once at onboarding. Tech-support impersonation scams work precisely because they sound routine.
If a business as security-conscious as Qantas can be caught out by one convincing phone call, it’s worth asking how your own team would handle the same approach.
Worried this affects your business? Get a free 15-minute IT check – call Trends IT on 0485 011 911 or visit /contact/.