How Airline Miles Could Vanish Into Hackers’ Hands in 2025

Qantas says a July 9, 2025 breach touched 5.7 million unique customer records, mostly names, email addresses, and frequent-flyer details, while stressing that no passwords, PINs, or points balances were compromised. The airline traced the Qantas cyber incident to a compromised call‑center system rather than the loyalty database, and it is urging customers to watch for phishing.

This disclosure arrives amid a broader wave of attacks on airline loyalty programs—where thieves try to turn airline miles into a shadow currency—putting travelers, migrants, and international students at risk of quietly losing rewards that help make long‑distance life possible.

Recent airline incidents and attacker tactics

• Air France‑KLM reported a June breach of a third‑party customer service platform, exposing names, contact details, and Flying Blue numbers, again without passwords or travel details.
• Law enforcement and private firms link these incidents to an ongoing campaign against major brands’ customer systems, including tools built on large CRM platforms.
• The hacker collective known as “Scattered Spider” has shifted attention to the airline sector, using phishing, social engineering, and help‑desk manipulation to access systems close enough to loyalty accounts to cause harm.

Airlines say the core vaults holding points often remain sealed. But the perimeter—vendors, call centers, and the human layer—keeps getting tested. In 2025, incidents at Hawaiian Airlines and WestJet disrupted services, with investigators focusing on groups skilled at tricking staff and third parties into handing over access.

Scale and trends in loyalty fraud

Cybersecurity firms tracking loyalty fraud report:

• Account takeovers have jumped by roughly 30–40% in the past year.
• An estimated 3% of points value is lost to fraud on average across programs.
• About 72% of major airline loyalty programs have been targeted by bots trying leaked username/password pairs.

This is industrial‑scale theft: attackers rarely need to break a vault. They need one weak lock—an old reused password, an unwary help‑desk chat, or an exposed vendor ticket with enough personal detail to mimic a real customer convincingly.

How small leaks become big losses

Qantas has experienced both insider and external threats:

• In 2024, an insider abuse case involving contractors reportedly diverted points from about 800 accounts, showing how legitimate access can be misused.
• In 2025, the call‑center platform breach exposed customer data slices that alone might not open an account, but combined with password reuse or a phishing text they can enable account takeovers.

Air France‑KLM’s disclosure follows the same pattern: hackers reached a third‑party customer service provider and accessed names, contact information, and loyalty numbers. Officials warned of follow‑on phishing and urged customers not to reply to unsolicited messages.

Impersonation of IT staff, rapid password resets, and pressure on tired help‑desk workers or contractors juggling multiple systems are common tactics.

Law enforcement and industry response

• The FBI and other agencies have issued alerts naming these groups among the most dangerous financially motivated actors targeting airlines today.
• Warnings focus on coordinated attempts to breach help desks, cloud admin consoles, and vendor accounts—places where a single reset can bypass customer protections.
• Airlines are deploying stronger controls, but attackers keep focusing on seams between companies and human moments when staff want to help a traveler locked out.

Real-world impact on travelers

For immigrants, students, and low‑income travelers, miles are often essential:

• Miles can fund emergency trips, visa interviews, and university travel.
• When accounts are drained or blocked for review, the costs are social and financial—family reunions, school plans, and urgent travel can vanish or become prohibitively expensive.
• Examples include caregivers losing emergency‑trip balances, students forced to buy costly tickets, and families paying peak fares when rewards disappear.

Defensive measures airlines are taking

Airlines and vendors are adopting multiple protections:

• Increasing multi‑factor authentication (MFA) adoption (though only about one‑third of programs require it as of 2025).
• Deploying bot detection and behavioral biometrics to spot unusual patterns like impossible login bursts.
• Requiring explicit confirmation for profile changes or high‑value redemptions.
• Limiting employee permissions, monitoring unusual redemption patterns, and requiring approvals for sensitive actions.

These steps create friction for attackers, forcing them to spend more time per target.

Why human factors remain the weakest link

Scattered Spider and similar groups rely heavily on social engineering:

• Convincing help desks to reset MFA after a fake “phone lost” story.
• Persuading vendors to push updates or act on fake requests.
• Hopping between vendors until a weak link is found.

Technology helps, but human pressure points—tired workers, overloaded call centers, and contractors with wide access—are still exploited.

Practical advice for customers

If you fear your account may have been touched by the Qantas breach or the campaign affecting Air France‑KLM, follow these practical steps:

1. Use strong, unique passwords and a password manager.
2. Turn on two‑factor authentication (2FA/MFA) and keep backup methods up to date.
3. Review recent redemptions and stored payment methods regularly.
4. Set up alerts for profile changes and points redemptions, if available.
5. Avoid clicking links in messages about account problems—log in via the official app or a bookmarked site.
6. If you suspect fraud, contact the airline through verified channels and request an account lock or added verification.
7. Monitor linked email accounts—access to email can let thieves reset passwords silently.

If a message claims you must act “now,” treat the urgency as a red flag. Verification—independent and patient—is often enough to stop a theft.

Customer‑controlled safety features to use

Some programs now offer extra protections customers can enable:

• In‑app approval requirements for major changes.
• Call PINs that must be presented during phone interactions.
• Notes on profiles requiring in‑app confirmation for redemptions.

Enable these where available and remove old saved cards or unnecessary partner links from your profile.

Regulatory and industry outlook

• Data protection authorities in Australia, France, and the Netherlands have opened inquiries tied to recent disclosures.
• Regulators are expected to tighten rules around third‑party access, data retention, and notification timelines.
• Industry expectations include stricter vendor screening, tighter access rules for contractors, and more investment in identity systems.

Analysts estimate the average cost of a U.S. data breach rose to about $10.22 million in 2025, encompassing technical recovery, legal matters, and trust damage—an expense that loyalty fraud contributes to.

Where to find official updates and guidance

• Qantas updates and advisories: https://www.qantasnewsroom.com.au
• Broader safety guidance and phishing/account protection resources: https://www.cyber.gov.au

If you receive suspicious messages or calls, verify independently: hang up and dial the number listed on the official site or app.

Final takeaway: the three pillars of protection

The long‑term solution rests on three complementary elements:

• Customer vigilance — good digital hygiene, MFA, and skepticism toward urgent requests.
• Airline investment — stronger authentication, anomaly detection, and rapid response.
• Vendor accountability — tighter controls, fewer retained data, and stricter access for contractors.

If all three hold, the industry can narrow the gap between the promise of loyalty programs and the risk of miles falling into the hands of criminals. Travelers don’t need perfection—just predictable rules and clear support when something goes wrong.

The Qantas cyber incident is a reminder that breaches can start at a call center and ripple outward without directly touching points. Treat personal loyalty details like the keys to a bank account: enable every protective feature, keep profiles tidy, and verify independently before responding to any unexpected request.