Qantas’ Cyber Incident, AT&T’s New Cyber Protection & ICC Probes New Incident

Recently, we reported that the Federal Bureau of Investigation (FBI), along with several cybersecurity firms, warned that the infamous hacking group known as Scattered Spider was shifting its focus to the airlines and the transportation sector, soon after hitting the insurance industry.

Prior to this, Scattered Spider went after the U.K. and U.S. retail sector—which came with prolonged issues for Marks & Spencer and Hertz, as well as Harrods and Co-op. The impact was so severe that Marks & Spencer’s CEO, Stuart Machin, said it would take until at least August to get over the attack, despite being hit on April 23, 2025.

At the same time, the FBI noted that it had “recently observed” cyberattacks in the airline sector that resembled Scattered Spider’s modus operandi.

The FBI’s warning was also echoed by Google’s Mandiant and Palo Alto Networks’ Cyber Threat Intelligence & Incident Response Division Unit 42.

Two airlines even reported being caught in the spider’s web, as Hawaiian Airlines was left addressing a cybersecurity event that affected some of its IT systems, and Canada’s WestJet faced a lengthy issue with its digital environment.

Now, we have a third victim.

Australia’s Qantas confirmed through a press release published on its website that a cyber incident occurred in one of its contact centers that impacted customer data.

The incident affected around 6 million customers who had service records on a third-party platform used by a Qantas airline contact center. Affected data is said to include customers’ names, email addresses, phone numbers, birth dates and frequent flyer numbers.

Credit card details, personal financial information and passport details are said to be safe, as such data isn’t stored on the system in question. Quantas also confirmed that no frequent flyer accounts were compromised, and no passwords, PIN numbers or log-in details were accessed.

However, this information comes from an initial review conducted by Qantas, and as it continues to conduct the investigation, the company is implementing “additional security measures” to improve system security, monitoring, and detection.

“We are continuing to investigate the proportion of the data that has been stolen, though we expect it will be significant,” said the airline.

Furthermore, Qantas has notified the Australian Cyber Security Center and the Office of the Australian Information Commissioner, as well as the Australian Federal Police.

“We sincerely apologize to our customers and we recognize the uncertainty this will cause. Our customers trust us with their personal information and we take that responsibility seriously,” said Vanessa Hudson, CEO, Qantas Group. “We are contacting our customers today and our focus is on providing them with the necessary support. We are working closely with the Federal Government’s National Cyber Security Coordinator, the Australian Cyber Security Centre and independent specialized cyber security experts.”

Customers can reach a dedicated support line—1800 971 541 or +61 2 8028 0534—as well as a dedicated page on qantas.com for the latest information about the incident.


On the brighter side of the cybersecurity realm, leading telecommunications company AT&T has introduced two new security features that offer users extra protection against cyberattacks and cybercriminals.

Wireless Account Lock helps users prevent unauthorized changes made to their accounts, including SIM swapping, where a bad actor moves a customer’s phone number to a SIM on a device that’s under their control. SIM swapping is also known as SIM hijacking.

The feature is easily accessible from a toggle button on their phone’s myAT&T app, and users can lock and unlock it at any time. This feature also disables key account changes, such as billing updates or wireless number transfers.

However, users will need to be available to unlock the account for a family member who “may want to buy a new device on the account or make other changes.”

AT&T also introduced a new Business Account Lock and an AT&T Prepaid wireless account lock with similar functions. When turned on, Business Account Lock disables actions such as device upgrades, SIM or eSIM changes, and number transfers for the user’s wireless devices and lines. Wireless Account Lock for AT&T Prepaid customers disables specific transactions and account changes.


Ahead of this, the International Criminal Court, which is also called “ICC” or “the Court,” revealed that it detected, confirmed, and contained a new, sophisticated and targeted cybersecurity incident.

The ICC is a permanent international court established to investigate, prosecute and try individuals accused of committing the most serious crimes of concern to the international community as a whole. This includes crimes such as genocide, crimes against humanity, war crimes and the crime of aggression.

The new incident is the second of this type against the ICC, with the previous one being carried out in October 2023.

“A Court-wide impact analysis is being carried out, and steps are already being taken to mitigate any effects of the incident,” reads an excerpt from the news release about the new incident. “The Court considers it essential to inform the public and its States Parties about such incidents as well as efforts to address them, and calls for continued support in the face of such challenges.

However, ICC didn’t reveal any technical details about the attack, nor did it specify if it suffered a data breach.


What do you think about the latest developments in the cybersecurity world?

Let us know in the comments below!