Qantas is among nearly 40 companies worldwide given until Friday to negotiate with hackers threatening to expose up to 1 billion personal records.
The group Scattered Lapsus$ Hunters reportedly posted the ransom demand on a dark web leaks site, warning that stolen data would be shared unless paid.
They claim to have obtained records from Salesforce databases belonging to 39 firms, including Toyota, Disney, McDonald’s, Puma, Cartier, Adidas, Qantas, Air France-KLM, Google Adsense, Chanel, and IKEA.
The cybercriminals insist both the affected companies and Salesforce contact them before 10 October regarding payment.
“Negotiate the ransom or all customer data will be leaked,” read the message to Salesforce, as seen by security sources.
The breach reportedly occurred between April 2024 and September 2025, compromising personal and contact details of customers and employees, including birthdates, purchase histories, and passport numbers.
Reports suggest airline customers' frequent flyer details were also accessed.
The hackers shared samples, including Qantas data following a prior attack in June that may have impacted 6 million customers.
A Qantas representative stated the airline remains focused on monitoring risks and assisting affected customers.
In July, Qantas secured a court order in New South Wales to block access, distribution, or publication of the stolen data.
“A dedicated support line and identity protection guidance remain available,” the spokesperson said.
Salesforce told CuriosityNews it refuses to negotiate with or pay extortionists.
The company said there is no evidence its systems were breached.
“We are aware of these threats, which experts and authorities investigated. Findings point to past or unverified incidents. We continue assisting impacted customers,” it stated.
Aiden Sinnott of Sophos noted Scattered Lapsus$ Hunters’ history of major leaks.
“Much of their activity involves misinformation, but they also release large datasets. If they possess Qantas data, a leak wouldn’t be surprising,” he said.
Google Threat Intelligence Group analysts suggest the hackers' credibility remains under scrutiny.
Read next
Jaguar Land Rover suppliers voice ‘everything is against us’ amid cutbacks
David Roberts, chair of Coventry-based Evtec, says the outlook for Britain’s automotive sector is grim, with “everything against us.” Evtec is a tier 1 supplier to Jaguar Land Rover, which this week announced 4,000 job cuts over two years despite chancellor John Healey’s attempt to talk
Europe’s fighter jet plans in disarray: what comes next?
When former ECB president and Italian PM Mario Draghi urged Europe to catch up economically with the US and China, defence collaboration was prescribed. No more should each nation build independent boats, tanks or jets; allies should share costs and technologies.
Europe stumbled at the first hurdle. German Chancellor Friedrich
John Healey supports growth but insists Labour must be truthful about spending
John Healey has stated that his primary goal as chancellor will be to boost economic growth, while acknowledging that Labour must be straightforward about controlling public spending at next month's budget.
In his first major address since assuming the role in July, Healey said the leading focus of