Identity-first defense is the lesson from the Qantas breach

At a glance

What this is: This is an analysis of the Qantas breach and what it shows about identity-led attacks through a third-party customer service platform, with personal data exposure affecting about 5.7 million customers.

Why it matters: It matters because IAM, PAM, and third-party access programmes need to assume valid credentials and vendor paths can be the attacker’s entry point, not just a post-breach concern.

Context

Identity-first breach patterns are those where attackers use social engineering, valid credentials, and trusted access paths rather than malware to move through an environment. In this case, the key governance gap is not a missing perimeter control but fragmented identity control across enterprise and third-party systems, which gives attackers room to reuse trust.

Qantas is a useful case because the intrusion route ran through a third-party customer service platform, not a direct compromise of the airline’s core estate. That makes the incident relevant to NHI, IAM, and contractor-access governance at the same time, because the failure mode sits in delegated access and identity boundaries.

The article’s central claim is that hybrid environments can no longer rely on isolated controls for Active Directory, cloud identity, PAM, and vendor access. Once identity becomes the attack path, containment depends on segmentation, protocol coverage, and response speed rather than only on prevention at the edge.

Key questions

Q: What breaks when third-party access is not governed as part of identity lifecycle management?

A: Access can outlive the business relationship that justified it, which leaves external identities active after need has ended. In healthcare, that failure can expose claims systems, patient data, and connected devices. The practical problem is not just excessive access, but access that no longer has an accountable owner.

Q: Why do legacy authentication protocols increase lateral movement risk?

A: They allow attackers to reuse captured authentication material instead of forcing a fresh, mutually verified login. When the protocol trusts the hash or supports relaying, one compromised endpoint can become a launching point for broader account impersonation and downstream system access.

Q: How should security teams respond when valid credentials are being used for suspicious movement?

A: They should move immediately to containment, not extended investigation first. That means deny or step up authentication, isolate affected machines or sessions, and trace the authentication path across on-prem and cloud systems. The priority is to stop further movement before the attacker expands access or disables visibility.

Q: What is the difference between phishing-resistant MFA and identity segmentation?

A: Phishing-resistant MFA strengthens how an identity proves possession of credentials, while identity segmentation limits where that identity can go once authenticated. Both matter, but they solve different problems. Strong authentication reduces credential abuse, and segmentation reduces blast radius when an attacker reaches a valid account or vendor path.

Technical breakdown

How social engineering becomes valid access

Scattered Spider-style operations begin by convincing a person or help desk process to issue, reset, or approve access that already looks legitimate to the identity stack. That is why these attacks are so effective in hybrid estates: the initial action is not a malware drop but an authorization event. The attacker does not need to break cryptography if they can persuade a human or support workflow to create a valid path into the environment. Practical implication: treat identity issuance, recovery, and support workflows as attack surfaces, not back-office administration.

Practical implication: harden help desk and recovery workflows as privileged entry points, not routine support tasks.

Why legacy protocols widen the attack surface

Legacy protocols such as NTLM, LDAP, and SMB often bypass modern authentication assumptions because they were not designed for phishing-resistant MFA or fine-grained conditional access. In mixed estates, that creates identity control gaps where an attacker can authenticate through older pathways even when newer systems are locked down. The problem is not that these protocols exist, but that they become exceptions to policy and therefore exceptions to visibility. Practical implication: map where legacy authentication still exists and treat it as a containment risk, not just a compatibility issue.

Practical implication: inventory and constrain legacy protocols that do not inherit modern authentication controls.

How lateral movement works when the attacker already has trust

Once attackers hold legitimate credentials, they can use normal administrative tools, remote access utilities, or cross-system trust relationships to move laterally while blending into expected activity. In hybrid environments, that movement can cross on-prem, cloud, and vendor-operated systems where identity telemetry is fragmented. The control challenge is not only detecting unusual commands, but correlating authentication flows across domains fast enough to stop scope expansion. Practical implication: build identity-layer monitoring that can block movement between trusted zones before privilege spread turns into full compromise.

Practical implication: segment identity flows and enforce inline response across on-prem and cloud trust boundaries.

Threat narrative

Attacker objective: The attacker objective was to reach trusted customer data and expand access through legitimate identity paths without triggering conventional perimeter defenses.

1. Entry via social engineering and third-party customer service access, where attackers obtained a valid path into the environment without malware-based intrusion.
2. Credential abuse followed, with the threat actor relying on legitimate credentials and trust relationships rather than overt exploit payloads.
3. Escalation occurred through lateral movement across connected systems and protocols that traditional controls often monitor poorly.
4. Impact was the exposure of personal data for approximately 5.7 million customers, creating downstream risk of impersonation and secondary attacks.

Breaches seen in the wild

• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
• Canvas Instructure Data Breach: ShinyHunters exploits Canvas LMS platform to expose millions of student records via third-party NHI credential abuse.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity-first defence is no longer a special case, it is the operating model. The Qantas breach shows that attackers do not need a sophisticated payload when they can exploit human trust, third-party access, and legacy identity paths. That means the boundary between IAM, PAM, and third-party access governance has collapsed in practice. The practitioner conclusion is simple: identity must be treated as the primary control plane, not a supporting function.

Third-party access without strict identity segmentation creates an identity blast radius. When a vendor or call-centre platform can reach customer systems, compromise of that path becomes a lateral movement opportunity, not just a supplier incident. This is where over-trusting business relationships becomes a security design flaw. The practitioner conclusion is to reduce shared trust zones and restrict vendor access to the minimum identity surface required.

Legacy authentication gaps are a governance problem, not only a technical debt problem. Protocols that cannot inherit modern authentication or conditional access controls leave defenders with inconsistent enforcement and incomplete visibility. That inconsistency is exactly what identity-led attackers look for. The practitioner conclusion is that protocol coverage must be part of access governance, or the control model remains uneven by design.

Containment speed is now a control objective in its own right. The article shows that once valid credentials are used, response delay creates room for the attacker to move, inspect, and persist before defenders can react. In identity-driven intrusions, the governance assumption that access can be reviewed before it matters is too slow. The practitioner conclusion is to design for immediate deny, reauthentication, and isolation decisions.

Phishing-resistant authentication helps, but it does not solve delegated trust. Passkeys and FIDO2 reduce the success rate of credential theft and replay, yet they do not neutralise the third-party access paths, legacy protocols, or trust relationships that made this breach possible. The broader point is that authentication strength and access architecture must be designed together. The practitioner conclusion is to align authentication hardening with identity segmentation and third-party lifecycle control.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: Identity Threat Detection and Response (ITDR) Guide

What this signals

Identity blast radius: when third-party access, legacy protocols, and hybrid trust zones overlap, compromise of one valid path can spread far beyond the original entry point. That is why identity-layer segmentation and rapid containment now matter as much as prevention. Security teams should assume the attacker may already be inside a trusted workflow when they first detect abnormal access.

The lesson for practitioners is not to treat supplier compromise as a separate governance lane. Third-party access, non-human identities, and human recovery workflows all sit on the same trust fabric once authentication is accepted. That means programme owners need one view of access paths, not separate views for cloud, on-prem, and vendor-operated systems.

For practitioners

• Tighten third-party access boundaries Map every vendor and call-centre path into customer-facing systems, then remove any access that is not explicitly needed for the service being delivered.
• Segment identity flows by trust zone Separate privileged identities from non-privileged environments and prevent vendor accounts from traversing unrelated systems through shared trust paths.
• Extend modern authentication to legacy protocols Identify NTLM, LDAP, and SMB dependencies and restrict them to the smallest viable set of systems instead of allowing them to remain open exceptions.
• Prepare identity containment policies in advance Predefine deny, MFA, and isolation actions so security teams can execute them immediately when suspicious identity behaviour appears across hybrid environments.
• Inventory non-human identities used by suppliers Include service accounts, automation credentials, and machine identities tied to third parties, then verify ownership, privilege scope, and offboarding coverage.

Key takeaways

• The Qantas breach shows that identity-led attacks can bypass traditional perimeter thinking by using trusted third-party access paths and valid credentials.
• The incident exposed personal data for about 5.7 million customers, which increases the likelihood of follow-on impersonation and secondary abuse.
• Identity segmentation, protocol coverage, and pre-planned containment are the controls most likely to limit the blast radius when attackers use legitimate access.

Key terms

• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Identity-layer segmentation: A control model that separates access by identity type, privilege level, and business criticality instead of treating the environment as one trust zone. It limits how far a compromised account can move by enforcing boundaries between privileged, standard, and third-party access paths.
• Third-Party Access Governance: Third-party access governance is the control set that tracks, approves, reviews, and revokes access granted to external vendors and partners. It becomes an identity problem when suppliers operate through shared credentials, delegated workflows, or persistent machine access that outlives the business need.
• Identity-first incident response: An incident response approach that treats authentication events, access paths, and credential abuse as the core evidence stream. Instead of focusing first on endpoints alone, it uses identity telemetry to contain sessions, isolate accounts, and trace movement across connected systems.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.