“With the help of specialist cyber security experts, we are investigating what data was part of the release,” Qantas said in a statement on Sunday.

The group said the data was “leaked” on Saturday, stating: “Don’t be the next headline, should have paid the ransom.”

How do you know if your data was exposed?

Arash Shaghaghi, a senior cybersecurity lecturer at the University of New South Wales, told SBS News customers should ensure any email communications they receive are legitimate and come from a legitimate @qantas.com address.

Receiving spear-phishing attacks is another sign of exposure that people can look out for. These types of attacks use personal information to deliver “highly-targeted” fraudulent electronic communications, such as emails and texts, to trick targets into divulging sensitive information.

What action should you take?

“It’s the single most effective defence against stolen data being used for account takeover,” he said.

Follow updates from Qantas and ACSC for verified information.

What can happen to data posted on dark web?

Matthew Warren, director at RMIT University’s Centre for Cyber Security, said the data leak would potentially lead to a “second wave of scams”.

“For example, scammers used data from the [2022] Optus breach months later to file fake credit applications and contact victims pretending to be banks or government agencies,” he said.

Will victims receive any compensation?

Compensation claims were made against Optus and Medibank following major data breaches in 2022.