Nearly 1000 Qantas customers have been caught up in a major cyber theft after an Indian company stole frequent flyer points in a serious breach of the airline company’s IT systems.
The Weekend Australian can reveal two third-party airport contractors in India have been suspended by their employer for inappropriate conduct, which involved accessing and making unauthorised changes to Qantas customer bookings. ...
...
Qantas said the fraud occurred because it operates flights to India where it uses a ground handling operator. It alleges staff at the local ground handling operator were able to access bookings – unrelated to India flights – and steal passengers’ information.
...
The alleged thieves used booking reference numbers and customer names to steal points. However, other sensitive personal data including passport details and date of birth would have been available on the Amadeus booking system. It is unknown if this information has been mis-used.
Customers caught up in the hack have not been notified by Qantas and the airline has yet to issue a public statement.
...
When Caitlin* and her husband went to check in for a $20,000-plus business class flight to London this August, the night before their flight they were concerned to discover their bookings were not showing up in the Qantas app. The booking was made through Qantas and did not involve flights with any other airlines.
“My first thought was there was a hacking event at Qantas,” Caitlin said.
...
After a frantic phone call on the day of travel with a Qantas offshore call centre; “the women I spoke to tried to question whether we had somehow just created brand new frequent flyer numbers,” Caitlin was finally put through to someone in Australia who fixed the problem.
...
Privately, after Caitlin asked Qantas customer service to find out what had happened, she was told it was likely because she had either clicked on a malware link or that there was a cyber breach at airline alliance Oneworld.
Neither explanation was correct.
...
* Last name withheld
