Qantas Among 40 Firms Targeted in Salesforce-Linked Extortion Campaign

Qantas is among about 40 major companies whose customer records were targeted in a sprawling extortion campaign this week after a hacker collective claiming to have stolen data from Salesforce-aligned systems threatened to publish the material unless ransoms were paid. The group, which uses the name Scattered Lapsus Hunters, said it had obtained a large trove of personal information dating from April 2024 to September 2025 and gave Salesforce and affected firms a deadline this week to begin negotiations. Portions of Qantas customer data were later posted on a dark web forum after the deadline passed.

Australian authorities and cybersecurity specialists are investigating. Qantas said the compromised dataset included the personal details of about 5.7 million frequent flyers, such as names, email addresses, phone numbers, dates of birth, addresses and frequent flyer numbers. The airline has said financial information, credit card details and passport numbers were not held on the affected Salesforce platform and were not exposed. In July Qantas notified customers of a separate incident that involved a third-party call centre.

The alleged intrusion did not, according to Salesforce...