Qantas will not face an investigation into a data breach that exposed the personal information of more than five million Australians, with the nation's privacy watchdog finding no apparent breach of privacy law despite the scale of the incident.
Last year, personal information stolen from the Australian airline was published to the dark web in a data breach that affected roughly 5.12 million Australians.
The Office of the Australian Information Commissioner (OAIC) has released the results of its preliminary inquiries into Qantas’ compliance with Australia’s Privacy Act and Notifiable Data Breaches Scheme following the breach, which was one of the largest in Australian corporate history.
After examining the circumstances surrounding the incident, Privacy Commissioner Carly Kind said the available evidence did not support the likelihood that Qantas had breached its privacy obligations.
“While I recognise the serious implications of data breaches such as this one on the lives of the Australian community, in this instance I do not consider that the evidence supports the likelihood that a breach of privacy law occurred,” said Kind.
Although Kind acknowledged Australians had questions about whether Qantas had taken appropriate steps to “secure the important personal information it had been entrusted with”, she ultimately confirmed the airline will not face immediate investigation.
“It would not be appropriate for the OAIC – a proportionate and risk-based regulator – to commence a full investigation or take further action at this stage,” said Kind.
“It is still open to the Commissioner to commence an investigation of Qantas with respect to these or other practices.”
Serious or repeated privacy breaches under the Privacy Act can attract maximum penalties of more than $50 million.
Qantas had its training, audits, and data hygiene in order
Even though Qantas customer data didn’t appear on the dark web until October, the inciting security incident occurred in June 2025.
OAIC explained a hacker had used phone-based social engineering techniques to essentially fool an offshore call centre employee into connecting a platform used by Qantas to a malicious data extraction tool.
Preliminary inquiries established that Qantas had undertaken a range of suitable preventative measures prior to the incident.
These included cyclical audits of the airline’s overseas provider, cyber and data protection training for contact centre agents, and processes for the destruction and de-identification of personal information once no longer required.
OAIC explained the incident was discovered two days after the social engineering attack occurred, and the airline immediately took steps to contain the incident.
These steps, according to OAIC, included analysing logs to identify an unauthorised login, ‘freezing’ and revoking access to the associated account, assessing what data exfiltration had occurred and triggering requisite incident response processes.
“Throughout our enquiries Qantas continued to actively monitor the [impacted customer relationship management platform] and notified us that there is no evidence of any further or ongoing threat actor activity,” wrote OAIC.
A Qantas spokesperson told Information Age that since the incident, the company has strengthened system monitoring and detection, increased training across its teams, and put in place additional security measures to support its customers.
“Protecting our customers’ personal information is a responsibility we take very seriously,” they said.
‘Unsatisfactory’, but consistent with the law
Blaine Hattie, principal at Sutton Laurence King Lawyers, said although “this is plainly an unsatisfactory situation” for those whose personal information was exposed, the OAIC’s findings appeared consistent with the law.
“[Australian Privacy Principle 11] does not impose liability automatically when a data breach occurs,” said Hattie.
“It requires reasonable steps, not perfect security.”
Hattie added that although Qantas had demonstrated the types of security measures needed when OAIC “comes knocking”, the OAIC report demonstrated an organisation can “theoretically comply with the Privacy Act while five million people lose their personal information”.
Notably, Qantas’ information retention policy allowed the airline to hold personal information for up to seven years from a customer’s most recent interaction.
Qantas was a victim, too
Based on the information provided, OAIC said it did not appear Qantas could have reasonably foreseen or prevented the breach.
Hattie noted it was “important to remember that Qantas was also the victim of a crime”.
“Organisations now face sophisticated cyberattacks from organised criminal groups,” he said.
“We should not become accustomed to a ritual bloodletting every time one succeeds.
“Punishing an organisation that took reasonable precautions could discourage prompt disclosure and cooperation after an incident.”
Though Australia's ongoing privacy reforms have expanded OAIC's penalty powers, civil penalties have only been imposed once – when pathology giant Australian Clinical Labs agreed to pay $5.8 million over its 2022 data breach.
OAIC has also pursued civil penalty proceedings against Optus and Medibank following their respective 2022 data breaches, with both cases ongoing at the time of writing.
