National law firm Maurice Blackburn has lodged a representative complaint against Qantas, seeking compensation on behalf of millions of customers whose personal data was compromised in the airline’s recent cyber attack.
On Monday 30 June 2025, Qantas detected unusual activity on a third-party platform used by a Qantas airline contact centre.
An initial review confirmed the stolen data includes customer names, email addresses, phone numbers, dates of birth and frequent flyer numbers.
No credit card details, personal financial information or passport details were stored on the compromised system and therefore were not accessed.
Maurice Blackburn principal lawyer Elizabeth O’Shea said the official complaint was lodged late yesterday with the OAIC, the authority charged with taking action over breaches of the Privacy Act.
“While we await a response and potential action from the OAIC in relation to Qantas failing to adequately protect the personal information of its customers, we would encourage Qantas customers who were impacted by the breach to register with us to receive updates about the representative complaint and compensation which may be sought on your behalf,” she said.
“It is early days in what we are learning about the mass data breach, but if you’re one of the millions of people that have had your personal information compromised, you’re eligible to register with us and we will keep you informed as the matter progresses.”
It comes as Qantas obtained an interim injunction in the NSW Supreme Court to try and stop the publication of the stolen data.
“We want to do all we can to protect our customers’ personal information and believe this was an important next course of action,” Qantas said in a statement.
There is no evidence that any personal data stolen from Qantas has been released, but Qantas said it was actively monitoring the situation with the support of cyber security experts.
The injunction means that in the event cyber criminals do post details on the dark web, others won’t be able to repost or publish the details.
Of the remaining 1.7 million, about 1.3 million had residential and business addresses, 1.1 million had date of birth, 900,000 had phone numbers, 400,000 their gender, and 10,000 their meal preferences impacted.
