Fake “Qantas IT Help” Vishing Led to Data Theft

How the Attack Worked

This incident began with a vishing call, a phone-based social engineering technique. An unnamed threat actor impersonating "Qantas IT help" contacted the airline's call centre and reached a customer service agent. Posing as internal IT support, the caller convinced the agent to connect a customized version of Salesforce's Data Loader tool to the CRM platform Qantas uses to manage customer records. That connection enabled mass extraction of data, ultimately affecting approximately 5.12 million people. The stolen data included personal information and frequent flyer information.

Why It Succeeded

The attack did not rely on malware or exploiting a software vulnerability. It relied entirely on the agent trusting an unsolicited call from someone claiming to represent internal IT. Call centre and customer service staff are trained to be responsive and helpful, which can make them a soft target when a caller sounds authoritative and uses internal-sounding language like "IT help." Once the agent agreed to connect the tool, the attacker had a direct path into the CRM with no further social engineering required.

What to Watch For

Customer-facing and CRM-adjacent teams should treat the following as red flags:

• An unsolicited call claiming to be internal IT support
• Any request to connect, install, or run a tool that can access customer data
• Pressure to perform unusual technical steps that fall outside an agent's normal duties

These patterns apply broadly across call centres, customer service desks, IT helpdesks, and CRM administration roles, all of which were identified as target audiences for this type of attack.

Building Resistance

Organizations with customer-facing teams and CRM access can reduce exposure to this type of attack by:

• Training staff to verify internal IT requests through a known callback process before taking any action, rather than trusting the caller's claimed identity
• Treating any request to connect external tools or change system access as high-risk, requiring supervisor or security approval
• Reinforcing that social engineering can lead directly to large-scale data loss, not just isolated account compromise

This case shows that a single successful vishing call, targeting one agent, can result in extraction of data at a very large scale. Preparing frontline staff with clear verification steps and escalation paths for unusual technical requests is a practical way to reduce this risk.

How did the Qantas vishing attack work?

An attacker called Qantas' call centre claiming to be internal IT support and convinced an agent to connect a customized version of Salesforce's Data Loader tool to the CRM, which enabled mass data extraction.

What data was stolen in the Qantas breach?

Stolen data included personal information and frequent flyer information affecting approximately 5.12 million Australians.

Why did the vishing call succeed?

The agent was convinced by an unsolicited call impersonating internal IT support and was pressured into performing an unusual technical step outside normal duties, without a verification process to catch the deception.

What can organizations do to prevent similar attacks?

Train customer-facing staff to verify internal IT requests through a known callback process and require supervisor or security approval before connecting any tool to a CRM system.