{"id":202555,"date":"2025-10-10T08:59:10","date_gmt":"2025-10-10T08:59:10","guid":{"rendered":"https:\/\/www.newsbeep.com\/au\/202555\/"},"modified":"2025-10-10T08:59:10","modified_gmt":"2025-10-10T08:59:10","slug":"fbi-seizes-and-destroys-website-linked-to-hackers-threatening-to-release-qantas-customers-data","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/au\/202555\/","title":{"rendered":"FBI ‘seizes and destroys’ website linked to hackers threatening to release Qantas customers’ data"},"content":{"rendered":"

The US Federal Bureau of Investigation (FBI) has seized and destroyed a publicly-accessible website run by hackers threatening to release Qantas customers’ personal data within the next 24 hours, according to a group claiming to be the hackers’ “administration team”.<\/p>\n

A cybercrime collective, Scattered Lapsus$ Hunters, has reportedly threatened to release stolen data from around 40 global firms linked to the cloud software giant Salesforce \u2014 including Disney, Google, IKEA, Toyota and airlines Qantas, Air France and KLM \u2014 unless a ransom was paid.<\/p>\n

In July, Qantas put the number of customers impacted by the cyber attack at 5.7 million but chief executive Vanessa Hudson would not confirm whether the company had been asked to pay a ransom.<\/p>\n

\"A<\/p>\n

The BreachForums website landing page on October 10 featured the logos of international law enforcement agencies. (Supplied: BreachForums)<\/p>\n

The collective’s deadline for the ransom payment is due to end at 11:59pm on Friday, New York time (1:59pm Saturday AEST).<\/p>\n

In a message posted online via the Telegram platform on Friday by the ShinyHunters group \u2014 one of three hacking groups that comprise the wider collective \u2014 all of its BreachForums website domains had been taken down.<\/p>\n

“BreachForums was seized by the FBI and international partners today. This was inevitable and I am not surprised. Neither I and others involved with this group have been arrested,” the message says.<\/p>\n

“BreachForums latest database backup was compromised along with every single database backup since 2023 till now \u2026 The backend servers itself were seized and destroyed.<\/p>\n

“I have no doubt the FBI and other international partners involved will be cracking down on many individuals in the next coming few weeks to months.<\/p>\n

Qantas responds to hackers threat<\/a><\/p>\n

Qantas says it is continuing to support customers as a hacking group threatens to release personal data from around 40 companies to the dark web.<\/p>\n

“The recent action the US Government has took against us, has no impact on our Salesforce campaigns.”<\/p>\n

The hacking group also claimed that the seizure marked the fourth time the FBI had taken law enforcement action against them over several years.<\/p>\n

The FBI and Qantas have not publicly commented on the claims about the website seizure. The ABC has contacted Qantas for further comment.<\/p>\n

A landing page still publicly-accessible on one of the BreachForums websites on Friday featured badge logos representing the FBI, US Department of Justice, the French National Jurisdiction prosecuting Serious Organised Crime and the French Cybercrime Brigade.<\/p>\n

Loading…<\/p>\n

The website seizure comes two days after Qantas confirmed it is continuing to support its customers<\/a> who have been impacted by the data breach.<\/p>\n

“Ensuring continued vigilance and providing ongoing support for our customers remain our top priorities following our cyber incident in early July,” a Qantas spokesperson said on Wednesday.<\/p>\n

“We continue to offer a 24\/7 support line and specialist identity protection advice to affected customers and through the ongoing injunction we obtained through the NSW Supreme Court we have legal protections in place to prevent the stolen data being accessed or released.”<\/p>\n

The airline was first granted an interim court injunction in July to pre-emptively block the release of customers’ personal data, despite saying that there was as yet “no evidence that any personal data stolen from Qantas has been released”.<\/p>\n

Inside the Trinity of Chaos <\/a><\/p>\n

Cybersecurity analysts warn Trinity of Chaos is still operating after recently announcing retirement.\u00a0<\/p>\n

Salesforce continues to maintain that it has received no indication that its platform has been compromised.<\/p>\n

Australian online security expert Troy Hunt told the ABC on Friday that he does not believe the FBI seizing the public-facing “clearweb” BreachForums domain will mean that Qantas customers’ personal data will not be published online via the dark web after the deadline ends on Saturday.<\/p>\n

“They have the data, they obviously have the website. To be honest, I’ll be very surprised if we don’t see some volume of data leaked tomorrow. They definitely won’t be getting any ransom,” he said.<\/p>\n

“The reality of it is, taking down a clearweb domain is going to have no impact on criminal elements in the same way that getting an injunction will have no impact on criminal elements.<\/p>\n

“Qantas should work on the assumption that it will be released and circulated broadly.<\/p>\n

“Unfortunately, what it means is that the worst possible people will have access to that data.”<\/p>\n

Aaron Bugal from the British cybersecurity firm Sophos echoed that sentiment.<\/p>\n

“While it appears law enforcement has temporarily disrupted their plans \u2014 taking down what’s believed to be the latest iteration of the BreachForums leak site \u2014 this is just one small win in a long game,” Mr Bugal said in a statement.<\/p>\n

“These cybercriminals talk a big game. They posture, threaten, and demand ransoms. But their bravado doesn’t change the fact that global law enforcement, across agencies with three and four-letter acronyms, is watching \u2014 and closing in.<\/p>\n

“This isn’t over. But for now, their countdown clock just hit a glitch.”<\/p>\n","protected":false},"excerpt":{"rendered":"The US Federal Bureau of Investigation (FBI) has seized and destroyed a publicly-accessible website run by hackers threatening…\n","protected":false},"author":2,"featured_media":202556,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[8170,64,63,99,43674,14279,126273,7810,38823,8886,3861,126274,120804],"class_list":["post-202555","post","type-post","status-publish","format-standard","has-post-thumbnail","category-business","tag-airlines","tag-au","tag-australia","tag-business","tag-cyber-crime","tag-data-breach","tag-data-leak","tag-fbi","tag-hackers","tag-hacking","tag-qantas","tag-scattered-lapsus-hunters","tag-shiny-hunters"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/202555","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/comments?post=202555"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/202555\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media\/202556"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media?parent=202555"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/categories?post=202555"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/tags?post=202555"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}