Qantas among nearly 40 companies facing ransom demand from hacker group

"The cybercriminal group is reportedly demanding both the victim companies and Salesforce contact them by 10 October about the payment of the ransom. Contact us to negotiate this ransom or all your customers data will be leaked, the note to Salesforce, as reported by Help Net Security, reads."

"It is understood the data was stolen between April 2024 and September 2025 and includes personal and contact information of the companies' customers and employees, including dates of birth, purchase histories and passport numbers. According to Cyber Daily, the criminals also claimed to have airline customers' frequent flyer numbers. The hackers' post contained samples of stolen data, including that of Qantas after a major cyber-attack in June that potentially exposed the records of up to 6 million customers."

"A Qantas spokesperson said its priorities were continued vigilance and providing ongoing support for our customers after the June attack. In July, Qantas obtained an ongoing injunction from the NSW supreme court ensuring protections to prevent the stolen data being accessed, viewed, released, used, transmitted or published by anyone, including third parties. We continue to offer a 24/7 support line and specialist identity protection advice to affected customers, the spokesperson said."

Almost 40 global companies, including Qantas, Toyota, Disney and Google Adsense, face ransom demands after a hacker collective claiming to be Scattered Lapsus$ Hunters posted an extortion note on a dark web data leaks site. The group claims to have stolen records from Salesforce databases and demands both victims and Salesforce contact them by 10 October to negotiate payment. Stolen data reportedly spans April 2024 to September 2025 and includes personal and contact details, dates of birth, purchase histories, passport numbers and frequent flyer numbers. Qantas states it is maintaining vigilance, offering customer support and holds a court injunction to protect stolen data.

Read at www.theguardian.com