Topic starter
24/06/2026 6:51 pm
TL;DR: Unosecur says the Qantas breach exposed data on up to 6 million customers after attackers entered through a third-party contact-centre platform, with social engineering and indirect access paths linked to Scattered Spider. Vendor identity governance now matters as much as internal perimeter control when supplier access can become the breach path.
Editorial analysis by NHI Mgmt Group, based on content published by Unosecur: “Qantas 2025 Data Breach: Third‑Party Risks in Aviation Sector”.
Key questions
Q: What breaks when a third-party contact-centre platform is trusted like an internal system?
A: The control boundary breaks first.
Q: Why do vendor support workflows increase breach risk in airline and outsourcing environments?
A: Because attackers can target the process that authorises access instead of attacking the perimeter directly.
Q: How do organisations know whether financial or identity controls are actually working?
A: They know by reconciling approvals, actual execution, and exception patterns over time.
Practitioner guidance
- Audit third-party access paths Inventory every vendor-operated platform, support workflow, and integration that can reach customer or employee data, then assign an accountable owner for each path.
- Tighten identity proofing for support changes Require stronger verification before help-desk actions that add devices, reset access, or approve privileged requests in partner environments.
- Review public-facing APIs tied to suppliers Check whether externally reachable APIs expose data or session-capable functions through weak authorization, shared accounts, or overbroad service permissions.
Bottom line: The breach demonstrates that third-party platforms can become the real identity perimeter when they hold customer data or broker privileged support actions.
What's in the full article
Unosecur's full blog covers the operational detail this post intentionally leaves for the source:
- Timeline details for the Qantas 2025 incident and the late-June detection window
- The article's breakdown of the vulnerable public-facing API and the access-control weaknesses around it
- The specific Scattered Spider tactics cited by the vendor, including impersonation and MFA bypass behaviour
- The legal, monitoring, and containment steps Qantas took after the incident, including the injunction and restrictions on remote/vendor connections
👉 Read Unosecur's analysis of the Qantas 2025 third-party breach →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 3:50 am
Third-party identity governance is now part of core enterprise security: This breach shows that supplier access is not a peripheral control concern, it is part of the attack surface. When a contact-centre platform can expose customer records, the enterprise has already extended trust beyond its own network. The practitioner conclusion is that vendor identity, not just vendor diligence, must be governed as a live access domain.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: When should security teams prioritise vendor identity governance over additional perimeter controls?
A: When the business depends on third-party platforms that can access sensitive data or operational workflows. Adding more perimeter tooling will not close the gap if suppliers, help desks, or outsourced contact centres already sit inside the trust model. In that situation, access governance and supplier oversight deliver more value than another boundary control.
👉 Read our full editorial: Qantas 2025 breach shows third-party identity risk is board-level