Confidential customer details exposed on Qantas site

Qantas’ online booking site today breached the privacy at least two of its customers, with their personal details revealed to another party when they attempted to access flight check-in information online.

Qantas customer Vicki Doust revealed the privacy breach to Australian PC World. She unearthed the error while attempting to access the company’s secure booking site.

She accessed the details using her personal booking number and details — provided by Qantas — to manage her online check-in for an upcoming flight. Doust’s initial attempt to access her flight and booking information failed. She attempted to log-in again, only to be presented with the personal details of two other Qantas customers.

The details included the full names of the two customers and their Qantas Frequent Flyer details, as well their home and mobile phone numbers, e-mail addresses and details of their travel itinerary, including return flight details and times.

Doust immediately contacted Qantas and said she had to escalate the call in the call centre in order to get the matter addressed immediately. “I spoke to the customer service supervisor, and he told me that yes, it was a serious issue and he did agree that it was a privacy concern”, said Doust.

The Australian Privacy Commissioner said that under the Privacy Act 1988 there is no requirement for an organisation to reveal the details to the Office of the Privacy Commissioner or affected customers if a breach occurs.

“While I cannot comment on this particular incident, in general, the Privacy Act requires organisations to take reasonable steps to ensure the security of personal information that they hold", said commissioner Karen Curtis.

"If an organisation fails in their obligations under the Privacy Act, they run the risk of breaching an individual's privacy and of having a privacy complaint lodged against them."

The Australian Law Reform Commission (ALRC) put forward a recommendation to the Privacy Commission that data breach notification become mandatory if there is a real risk of serious harm occurring as a result of a breach. The Federal Government will be considering the data breach recommendation in the second stage of its response to a report on privacy law in Australia.

The privacy commissioner advises customers who think their information has been handled inappropriately to contact the party responsible to remedy the matter. "If a person believes that their information has been handled inappropriately, they should complain to the organisation as a first step. If the person is unable to obtain a response from the organisation, or is dissatisfied with the response, they can then lodge a complaint with my office", said Curtis. The Office of the Privacy Commissioner has published a voluntary "Guide to handling personal information security breaches".

Doust said she asked the Qantas customer service supervisor if she could be advised of the outcome or resolution to the breach but she was told to "put it in writing" as he did not know if he could provide the follow-up information or how long a resolution would take.

Lloyd Quartermaine, a Qantas media spokesperson, said the company's technical team was still looking into the matter but was unable to say yet what had caused the incident.