Privacy Commissioner completes preliminary inquiries into Qantas 2025 data incident

The Australian Privacy Commissioner published a report on 16 July 2026 concluding the OAIC's preliminary inquiries into the 2025 Qantas Airways Limited data breach, which affected approximately 5.12 million Australians. The breach arose from a social engineering attack, in which a threat actor impersonating Qantas IT support contacted an overseas third-party contact centre provider and obtained access that enabled mass extraction of customer data, including personal information and frequent flyer details, from the customer relationship management platform used by Qantas.

Following close to a year of inquiries, during which Qantas provided information and documents to the regulator, Commissioner Carly Kind concluded that the evidence did not support a likelihood that Qantas had failed to take reasonable steps to protect the personal information it held, or that it had failed to take reasonable steps to ensure its overseas third-party provider complied with the Australian Privacy Principles covering management, cross-border disclosure and security of personal information. On that basis, the Commissioner determined it would not be proportionate for the OAIC to commence a full investigation or take further action at this stage.

The Commissioner's findings are described as provisional, and the OAIC retains discretion to open a formal investigation later if new information emerges. The matter illustrates that preliminary inquiries into a large-scale breach will closely examine both an entity's own security measures and the steps taken to ensure compliance by third-party providers handling personal information on its behalf, even where those inquiries conclude without further action.