Australia is reeling from a major cybersecurity incident after hackers released personal data belonging to an estimated 5.7 million Qantas customers onto the dark web.

In a public broadcast, Home Affairs and Cyber Security Minister Tony Burke urged Australians not to search for their stolen data online, citing legal risks and heightened exposure to AI-enabled scams.

The breach is part of a wider extortion campaign by the collective known as Scattered Lapsus$ Hunters, who claimed to have accessed data from 39 firms using Salesforce platforms, including Qantas, Toyota, Disney, McDonald’s and Ikea.

The group had demanded ransom from Salesforce by October 11 local time— a deadline that passed without payment.

Qantas confirmed that the exposed information included names, email addresses, birthdates, contact details, frequent flyer numbers, status tiers and points balances.

Critically, the airline emphasised that no passport information, credit card or financial data, passwords, personal login credentials or PINs were stolen.

Although Qantas filed a court injunction with the New South Wales Supreme Court to block broader dissemination of the breached data, the hackers proceeded to publish some records.

In response, the airline has activated a 24/7 support line for affected customers and is working with cybersecurity teams, the Australian Cyber Security Centre and the Australian Federal Police to assess the fallout and contain further damage.

Toyota, meanwhile, stated it conducted an internal investigation but found no evidence that Australian customer data had been compromised.

The company reaffirmed its high standards for data security and said it continues to monitor the situation.

Minister Burke strongly cautioned the public: “No one should go looking for (the stolen data) on the dark web.

It’s illegal to access it, so even if you’re looking for your own material, don’t go looking for it”.

He warned of complex, AI-enhanced scam attempts using personal data, urging Australians to remain vigilant.

He added that, while many individuals’ phone numbers and addresses were not affected, some are—but even so, unsolicited “cold calls” that claim legitimacy must be treated with skepticism.

His advice: hang up and contact the institution via trusted numbers rather than responding to uncertain claims.

The federal government has pledged full support to Qantas and other affected entities.

Intelligence agencies, including the National Cyber Security Coordinator and the Australian Signals Directorate, are collaborating with the airline to trace the source and penetrations.

As investigations proceed, legal consequences loom: a class action has already been initiated alleging Qantas failed to protect customer data adequately.

Meanwhile, cybersecurity experts warn the breach offers ample fuel for fraudsters.

Stolen data of this nature is prime fodder for phishing, identity theft and fraud—especially when paired with generative AI techniques.

Australians are now being urged to tighten digital defenses: enforce software updates, adopt strong passphrases, enable multi-factor authentication, and verify contacts independently.