I have just called the customer support line they provided in the email.
Irony of ironies, it appears to be outsourced, this time to Britain, and of course they had to ask for my details (apparently they hadn't purchased them from the hacker yet).
I asked whether Qantas will be indemnifying...