Qantas Airways has confirmed a major cyberattack on a third-party customer service platform that exposed the personal information of up to six million customers, marking Australia’s most significant data breach in years.

In a statement released Wednesday, the airline said a hacker targeted a call centre and accessed a database containing names, email addresses, phone numbers, dates of birth, and frequent flyer numbers.

The airline did not disclose the location of the affected call centre or specify which customer groups were impacted.

Qantas said it detected unusual activity on the platform and acted swiftly to contain the breach. “We are continuing to investigate the proportion of the data that has been stolen, though we expect it will be significant,” the company stated, adding that flight operations and safety systems were not affected.

The breach draws renewed attention to Qantas as it continues efforts to restore public trust following a string of reputational crises in recent years. These include illegal staff layoffs during the COVID-19 pandemic, the sale of tickets for cancelled flights, and a political controversy over market competition with Qatar Airways.

Security experts say the breach may be part of a broader, coordinated wave of cyberattacks targeting airlines. While Qantas did not attribute the attack to a specific group, it follows warnings from the FBI that cybercrime gang Scattered Spider has targeted multiple carriers, including Hawaiian Airlines and Canada’s WestJet.

Qantas CEO Vanessa Hudson, who took over in 2023 and has since worked to improve the airline’s image, acknowledged the breach’s seriousness. “We recognise the uncertainty this will cause. Our customers trust us with their personal information and we take that responsibility seriously,” she said.

Authorities including the Australian Cyber Security Centre and Federal Police have been notified. Qantas shares fell 2.4% in afternoon trading following the news.