Fake “Qantas IT Help” Call Led to 5.7M Leak

How the attack worked

The breach began with a phone call, not malware or a phishing email. An attacker called a contact center agent and claimed to represent internal IT support, using the phrase “Qantas IT help” to establish credibility. The caller then instructed the agent to log into a CRM system and perform specific steps that were framed as necessary to close a routine support ticket.

Instead of resolving a ticket, those steps connected the CRM to a data extraction tool controlled by the attacker. That tool was then used to siphon off customer records, ultimately affecting around 5.7 million people. No malware needed to be installed and no credentials needed to be stolen through a fake login page. The agent's own legitimate access was used against the organization.

Why it succeeded

This attack worked because it exploited trust in internal processes rather than technical weaknesses. A few factors stand out:

• The caller impersonated a familiar, authoritative internal function (IT support), which lowers an agent's guard compared to an external or unknown caller.
• The request was framed as a routine task, closing a support ticket, rather than something obviously suspicious like sharing a password.
• The actions requested blended in with normal CRM administration, making it hard for the agent to recognize that a system integration was being changed.
• Australia's Privacy Commissioner noted that role-based access controls alone might not have reasonably prevented this outcome, since the agent was acting within their normal scope of access.

What to watch for

Contact center and CRM-adjacent staff should be alert to these signals:

• Unsolicited calls claiming to be internal IT support, especially ones that arrive without a prior ticket or request from the agent.
• Pressure to complete unfamiliar CRM steps framed as necessary to “close a ticket.”
• Instructions that involve connecting tools, granting access, or changing system settings rather than standard customer-service tasks.

These red flags apply broadly to service desk, CRM administrator, and privacy/compliance teams, not just frontline agents.

How to build resistance

Organizations can reduce exposure to this kind of pretext by combining process and awareness:

• Require call-back verification through an official internal directory or ticketing portal before acting on any unsolicited “IT support” request.
• Train staff to pause and escalate whenever a request involves changing integrations, enabling access, or connecting external tools, even if it's framed as routine.
• Run realistic vishing exercises built around common workflows like “closing a support ticket,” since attackers weaponize normal business processes rather than obviously malicious requests.
• Reinforce that verifying identity is not a sign of distrust toward colleagues, but a standard safeguard against impersonation.

This incident illustrates how a single well-crafted phone call, aimed at a routine workflow, can lead to a large-scale data exposure without any conventional hacking.

How did the attacker gain access to customer data?

An attacker called a contact center agent claiming to be internal IT support, then coached the agent through CRM steps that instead connected the system to a data extraction tool used to steal customer records.

Was this a technical hack or a social engineering attack?

It was a social engineering attack, specifically a vishing (voice phishing) call that impersonated internal IT support rather than a technical exploit.

Could stronger access controls have prevented this breach?

According to the Privacy Commissioner's findings, the breach could not necessarily have been foreseen and prevented through role-based access controls alone, since the agent was manipulated into performing actions within their normal permissions.

What roles are most at risk from this type of attack?

Contact center and customer service agents, service desk and IT support teams, CRM administrators, and privacy or compliance teams are the primary targets for this kind of pretext.