Frustration mounts among Qantas customers over data breach

Qantas is facing significant reputational and financial risks after personal data for 5.7 million customers was released on the dark web following a failed ransom payment. The breach, stemming from a July phishing attack on a call center accessing Salesforce, has led to speculation about severe financial penalties under the Australian Privacy Act, with experts suggesting any fines must be substantial given Qantas's recent $1.6 billion profit to incentivize improved cybersecurity. The airline's ultimate liability remains uncertain, particularly concerning third-party platforms, while affected customers are now vulnerable to a potential second wave of scams.

Analysis

Qantas faces significant fallout after personal data for 5.7 million customers was released on the dark web by Scattered Lapsus$ Hunters following an unpaid ransom. This breach, stemming from a July phishing attack targeting a call center worker accessing the Salesforce platform, exposes sensitive personally identifiable information. Customer frustration is mounting due to poor communication and the heightened risk of a "second wave of scams."

The incident carries substantial financial and regulatory risks for Qantas, with speculation of severe penalties under the Australian Privacy Act. Experts argue any fine must be significant, given Qantas's recent $1.6 billion full-year profit, to serve as a deterrent and incentivize improved cybersecurity. The Office of the Australian Information Commissioner has not commented on potential fines.

A key legal question revolves around Qantas's liability, particularly concerning the role of the third-party platform, Salesforce (CRM). Determining whether Qantas or Salesforce held the stolen customer data will be crucial in assessing potential breaches of Australian privacy principles. This highlights broader third-party vendor risk management challenges.

Overall sentiment surrounding Qantas is strongly negative and pessimistic, reflecting the severity of the data breach and its implications for customer trust and corporate governance. The incident underscores increasing regulatory scrutiny and the financial consequences of inadequate cybersecurity measures across industries.

Key Decisions for Investors

• Investors should monitor the ongoing regulatory investigation and potential financial penalties under the Australian Privacy Act, as these could materially impact Qantas's profitability and valuation.
• Evaluate Qantas's (and other portfolio companies') third-party vendor risk management practices, particularly concerning data security protocols with providers like Salesforce (CRM), given the unclear liability in this case.
• Consider the broader implications for the airline sector and other industries regarding increased cybersecurity investment requirements and potential for similar data breach-related litigation and reputational damage.