Confidential customer details exposed on Qantas site

Personal customer information revealed on a secure section of the Qantas site.

A Qantas’ customer was able to access other customers’ details when accessing her online check-in details at the secure booking site today.

A Qantas’ customer was able to access other customers’ details when accessing her online check-in details at the secure booking site today.

Qantas’ online booking site today breached the privacy at least two of its customers, with their personal details revealed to another party when they attempted to access flight check-in information online.

Qantas customer Vicki Doust revealed the privacy breach to Australian PC World. She unearthed the error while attempting to access the company’s secure booking site.

She accessed the details using her personal booking number and details — provided by Qantas — to manage her online check-in for an upcoming flight. Doust’s initial attempt to access her flight and booking information failed. She attempted to log-in again, only to be presented with the personal details of two other Qantas customers.

The details included the full names of the two customers and their Qantas Frequent Flyer details, as well their home and mobile phone numbers, e-mail addresses and details of their travel itinerary, including return flight details and times.

Doust immediately contacted Qantas and said she had to escalate the call in the call centre in order to get the matter addressed immediately. “I spoke to the customer service supervisor, and he told me that yes, it was a serious issue and he did agree that it was a privacy concern”, said Doust.

The Australian Privacy Commissioner said that under the Privacy Act 1988 there is no requirement for an organisation to reveal the details to the Office of the Privacy Commissioner or affected customers if a breach occurs.

“While I cannot comment on this particular incident, in general, the Privacy Act requires organisations to take reasonable steps to ensure the security of personal information that they hold", said commissioner Karen Curtis.

"If an organisation fails in their obligations under the Privacy Act, they run the risk of breaching an individual's privacy and of having a privacy complaint lodged against them."

The Australian Law Reform Commission (ALRC) put forward a recommendation to the Privacy Commission that data breach notification become mandatory if there is a real risk of serious harm occurring as a result of a breach. The Federal Government will be considering the data breach recommendation in the second stage of its response to a report on privacy law in Australia.

The privacy commissioner advises customers who think their information has been handled inappropriately to contact the party responsible to remedy the matter.

"If a person believes that their information has been handled inappropriately, they should complain to the organisation as a first step. If the person is unable to obtain a response from the organisation, or is dissatisfied with the response, they can then lodge a complaint with my office", said Curtis.

The Office of the Privacy Commissioner has published a voluntary "Guide to handling personal information security breaches".

Doust said she asked the Qantas customer service supervisor if she could be advised of the outcome or resolution to the breach but she was told to "put it in writing" as he did not know if he could provide the follow-up information or how long a resolution would take.

Lloyd Quartermaine, a Qantas media spokesperson, said the company's technical team was still looking into the matter but was unable to say yet what had caused the incident.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags privacyQantas

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Amanda Conroy

PC World
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers

MSI P65

This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang

MSI GT76

It really doesn’t get more “gaming laptop” than this.

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?