\n<\/p>\n
It\u2019s become the playbook for big Australian companies that have customer data stolen in a cyber-attack: call in the lawyers and get a court to block anyone from accessing it.<\/p>\n
Qantas ran it after suffering a major cybersecurity attack that accessed the frequent flyer details of 5 million customers.<\/p>\n
The airline joined the long list of companies in Australia, dating back to the HWL Ebsworth breach in 2023, to go to the New South Wals supreme court to obtain an injunction against \u201cpersons unknown\u201d \u2013 banning the hackers (and anyone else) from accessing or using the data under threat of prosecution.<\/p>\n
Of course, it didn\u2019t stop hackers leaking the customer data on the dark web a few months later.<\/p>\n
But it might have come as a surprise when the ID protection company Equifax this month began alerting Qantas customers that their data had been leaked \u2013 since access to the data was supposedly banned.<\/p>\n
This highlights the major flaw in the injunction scheme. Qantas argues the injunction protects customers, but cybersecurity experts warn that in practice it has the opposite effect: scammers will ignore it, while organisations based in Australia and operating within the law will not be able to verify the data and report on it.<\/p>\n
Sign up: AU Breaking News email<\/p>\n
Troy Hunt, an Australian who operates the HaveIBeenPwned website which notifies users when their information appeared in breaches, is frustrated that he has not been able to include the breach in his searchable database.<\/p>\n
\u201cClearly the injunction has not stopped even legally operating organisations from accessing the data and communicating with the customers,\u201d he said.<\/p>\n
\u201c[Qantas is] obviously trying to minimise damage, and they will inevitably get raked over the coals with class actions, because it happens to every big company that has a breach now \u2026 but there is just no measurable, practical benefit that anyone can assign to keeping this data out of the hands of people like [me], whilst it\u2019s in the hands of people who are now abusing it.\u201d<\/p>\n
Hunt noted the irony that Qantas\u2019s cybersecurity incident statement on its website links out to government resources for customers caught up in a breach. Those resources advise customers to visit Hunt\u2019s website so they can better protect themselves by being aware of what information is out there.<\/p>\n
How Equifax approached the injunction is unclear. The company said it uses the cybersecurity company Norton to monitor the dark web. Norton\u2019s parent company Gen Digital is based in the US and Czechia while Equifax is US-based.<\/p>\n
Norton did not deny it had accessed the data when asked twice by Guardian Australia, saying in a statement it is \u201ccontractually obligated to notify customers\u201d when their information is posted on the dark web.<\/p>\n
skip past newsletter promotion<\/p>\n
Sign up to Breaking News Australia<\/span><\/p>\n Get the most important news as it breaks<\/p>\n Privacy Notice: <\/strong>Newsletters may contain information about charities, online ads, and content funded by outside parties. If you do not have an account, we will create a guest account for you on theguardian.com to send you this newsletter. You can complete full registration at any time. For more information about how we use your data see our Privacy Policy. We use Google reCaptcha to protect our website and the Google Privacy Policy and Terms of Service apply.<\/span><\/p>\n after newsletter promotion<\/p>\n \u201cThese alerts are part of our ongoing commitment to help victims of a data breach protect their personal information and respond quickly if their data is at risk,\u201d the spokesperson said. \u201cThis service operates under strict business, privacy, and compliance standards to ensure accuracy and lawful handling of all data sources.\u201d<\/p>\n Qantas would not confirm if it was considering pursuing companies for potential contraventions of the injunction, but indicated it was monitoring third-parties and would consider them on a case-by-case basis.<\/p>\n \u201cWe are aware of notifications being sent to some of our customers by a third-party providers. These notifications include types of personal information that was not held in the system impacted in our July cyber incident,\u201d the spokesperson said.<\/p>\n According to screenshots from the Telegram group run by the hackers, posted this month by Hunt, the hackers are aware of the limitations of the injunction.<\/p>\n \u201cqantas why are you lying to your citizens?\u201d the message states. \u201call your injunction does is prevent media\/journalists.\u201d<\/p>\n \u201cYOUR data WILL be released and it WILL BE accessed.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":" It\u2019s become the playbook for big Australian companies that have customer data stolen in a cyber-attack: call in the lawyers and get a court to block anyone from accessing it. Qantas ran it after suffering a major cybersecurity attack that accessed the frequent flyer details of 5 million customers. The airline joined the long list<\/p>\n","protected":false},"author":1,"featured_media":32045,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[52],"tags":[2807,7250,4219,1151,1111,18567,8992,4124,2500,10699,18568],"class_list":{"0":"post-32044","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-technology","8":"tag-brands","9":"tag-consumers","10":"tag-corporate","11":"tag-cybercrime","12":"tag-data","13":"tag-kneejerk","14":"tag-leaks","15":"tag-protect","16":"tag-qantas","17":"tag-responses","18":"tag-screwed"},"_links":{"self":[{"href":"https:\/\/naijaglobalnews.org\/index.php?rest_route=\/wp\/v2\/posts\/32044","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/naijaglobalnews.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/naijaglobalnews.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/naijaglobalnews.org\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/naijaglobalnews.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=32044"}],"version-history":[{"count":0,"href":"https:\/\/naijaglobalnews.org\/index.php?rest_route=\/wp\/v2\/posts\/32044\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/naijaglobalnews.org\/index.php?rest_route=\/wp\/v2\/media\/32045"}],"wp:attachment":[{"href":"https:\/\/naijaglobalnews.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=32044"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/naijaglobalnews.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=32044"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/naijaglobalnews.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=32044"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}