Company Interview / Qantas still navigating turbulence

Key points:

Qantas (ASX: QAN) data breach involves significant personal information exposureSocial engineering identified as a primary tactic used by attackersFurther investigation into Qantas’ security protocols and third-party vendors neededPotential for a class action, similar to the Optus precedent

Aashish Srivastava from Monash University addresses the recent cyber attack on Qantas (ASX: QAN), describing the breach as comparatively serious, particularly regarding personal identifiable information such as names, dates of birth, and frequent flyer numbers. Srivastava highlights the risk posed by potential dictionary attacks that could compromise accounts if attackers generate pin numbers via software. He strongly recommends that affected customers act cautiously: changing pins and passwords, and avoiding any unsolicited communication that requests account information.

Srivastava attributes the success of the breach to social engineering, where threat actors, such as the group "scatter spider", impersonate customers or vendors to deceive company representatives. Such methods enable access even within organisations with security measures in place. He notes that Qantas responded appropriately by notifying customers and the Office of the Australian Information Commissioner, but emphasises the necessity of further investigation into the root cause and potential shortcomings within the company’s security protocols or those of its third-party vendors.

Srivastava sees a significant possibility of class action similar to the one involving Optus, given the extent of the breach and precedent in Australia. He maintains that the threat of future attacks remains high both in Australia and globally, citing Equifax Secure as another major example. Regular updates to security software and encryption methods remain critical.