{
  "type": "bundle",
  "id": "bundle--00434fc0-bd0b-5ca2-8b68-113153279320",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--1ac6582d-4c9c-53bd-8d96-7391f4021499",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "org:b6e236f9-b355-4845-9107-443ee63bf9b2",
      "name": "Qantas Airways Limited",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--0fd5ac53-584c-563f-8fb8-f1bb6061e3e0",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "brh:88063dff-0f90-45b9-a972-41471aa7c8b0",
      "name": "Qantas contact-centre data breach"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--6be635ce-aab2-54c0-898d-4cf3248317c9",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "inc:765fef87-704d-4d6e-a8bc-f9046877ebb7",
      "name": "June 2025 Qantas contact-centre compromise"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--138c14f5-5b52-52d0-8c12-89415ba28d06",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "clm:ffc728cf-6c3c-4331-bdd5-cfef08fa181e",
      "relationship_type": "resulted-in",
      "source_ref": "incident--6be635ce-aab2-54c0-898d-4cf3248317c9",
      "target_ref": "x-ally-notification--9846eb65-8fa1-5385-8e27-095397f46a24",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Office of the Australian Information Commissioner",
          "url": "https://www.oaic.gov.au/privacy/privacy-assessments-and-decisions/privacy-decisions/Investigation-inquiry-reports/report-into-preliminary-inquiries-of-qantas",
          "external_id": "cit:d27cbd58-e369-4fce-bd03-80bec3c81919",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:dcc1461f8212afa32672611cc20a3310124e3d37168324a7d7a3e6f444bbf53b"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1fc58f04-9e7b-56ba-8c87-b11fa7cb674f",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "clm:2b0e018c-c0b6-4baa-9b96-1382bfc0896e",
      "relationship_type": "exposed-data-category",
      "source_ref": "x-ally-data-exposure--591b8c27-73a2-5489-8955-5d193e43a13f",
      "target_ref": "x-ally-data-category--c79f34f3-405d-57d2-8409-98eff3898231",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Qantas Airways Limited",
          "url": "https://agencyconnect.qantas.com/en/news/jul-2025/qantas-cyber-incident",
          "external_id": "cit:68ea43fa-513b-4277-8090-f4ee51a76a99",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:c44d788110f5181f7207ff4846d7a32d639a78490e7301b8a1ef58ed4f278a28"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--563f97db-ba59-52e4-818c-45989fafa523",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "clm:0ac8f473-34d2-4268-b7ec-4b8f58e8986c",
      "relationship_type": "exposed-data-category",
      "source_ref": "x-ally-data-exposure--591b8c27-73a2-5489-8955-5d193e43a13f",
      "target_ref": "x-ally-data-category--a2b7dd9d-0c02-5710-88ed-ea507d0ffa07",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Qantas Airways Limited",
          "url": "https://agencyconnect.qantas.com/en/news/jul-2025/qantas-cyber-incident",
          "external_id": "cit:e9f53f7e-9a4b-4502-8d32-2600102e52fd",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:c44d788110f5181f7207ff4846d7a32d639a78490e7301b8a1ef58ed4f278a28"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5fefd491-7c35-5f9e-8318-e92ce48c3147",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "clm:2b07591f-0699-412b-9786-6d1754f795c2",
      "relationship_type": "affected-organization",
      "source_ref": "incident--6be635ce-aab2-54c0-898d-4cf3248317c9",
      "target_ref": "identity--1ac6582d-4c9c-53bd-8d96-7391f4021499",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Office of the Australian Information Commissioner",
          "url": "https://www.oaic.gov.au/privacy/privacy-assessments-and-decisions/privacy-decisions/Investigation-inquiry-reports/report-into-preliminary-inquiries-of-qantas",
          "external_id": "cit:1f576eb8-bcdd-4783-b681-5a16547c4669",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:dcc1461f8212afa32672611cc20a3310124e3d37168324a7d7a3e6f444bbf53b"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6a59075e-20a5-5f99-837f-f55e77e24c58",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "clm:c7f28b80-4957-4603-8cb8-a408fc60131e",
      "relationship_type": "resulted-in",
      "source_ref": "incident--6be635ce-aab2-54c0-898d-4cf3248317c9",
      "target_ref": "x-ally-data-exposure--591b8c27-73a2-5489-8955-5d193e43a13f",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Office of the Australian Information Commissioner",
          "url": "https://www.oaic.gov.au/privacy/privacy-assessments-and-decisions/privacy-decisions/Investigation-inquiry-reports/report-into-preliminary-inquiries-of-qantas",
          "external_id": "cit:00249ca9-10e2-4b9f-96c3-513cdde90a0a",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:dcc1461f8212afa32672611cc20a3310124e3d37168324a7d7a3e6f444bbf53b"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bc995ea2-c685-5b5e-8126-6ca41dce4115",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "clm:72eda751-9695-4a3c-9668-b5543e7ab8b5",
      "relationship_type": "exposed-data-category",
      "source_ref": "x-ally-data-exposure--591b8c27-73a2-5489-8955-5d193e43a13f",
      "target_ref": "x-ally-data-category--ff2c8174-4feb-535f-8a4d-be23ee26eff2",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Office of the Australian Information Commissioner",
          "url": "https://www.oaic.gov.au/privacy/privacy-assessments-and-decisions/privacy-decisions/Investigation-inquiry-reports/report-into-preliminary-inquiries-of-qantas",
          "external_id": "cit:6840d1b1-f6f0-4d24-bbf5-6ff9e7074529",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:dcc1461f8212afa32672611cc20a3310124e3d37168324a7d7a3e6f444bbf53b"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c26683fa-3b83-55ba-848e-a25e62c57120",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "clm:ad096af9-80be-47e9-844e-678cd0790665",
      "relationship_type": "exposed-data-category",
      "source_ref": "x-ally-data-exposure--591b8c27-73a2-5489-8955-5d193e43a13f",
      "target_ref": "x-ally-data-category--b82a6005-4623-5256-83d6-809edefdbbbe",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Office of the Australian Information Commissioner",
          "url": "https://www.oaic.gov.au/privacy/privacy-assessments-and-decisions/privacy-decisions/Investigation-inquiry-reports/report-into-preliminary-inquiries-of-qantas",
          "external_id": "cit:73f4a76f-83b0-4757-9dcc-7e58d6fcb964",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:dcc1461f8212afa32672611cc20a3310124e3d37168324a7d7a3e6f444bbf53b"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--caef9b9d-1937-5352-8fd0-fe01f966c5aa",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "clm:de3ef1c8-aaf9-46f7-9d87-741254913d57",
      "relationship_type": "exposed-data-category",
      "source_ref": "x-ally-data-exposure--591b8c27-73a2-5489-8955-5d193e43a13f",
      "target_ref": "x-ally-data-category--40ba6c78-b66b-5dcd-8ee9-5f2789f80585",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Office of the Australian Information Commissioner",
          "url": "https://www.oaic.gov.au/privacy/privacy-assessments-and-decisions/privacy-decisions/Investigation-inquiry-reports/report-into-preliminary-inquiries-of-qantas",
          "external_id": "cit:c5f4b79e-df02-4370-8681-95362fd1c113",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:dcc1461f8212afa32672611cc20a3310124e3d37168324a7d7a3e6f444bbf53b"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--da3a5717-abd5-5100-840b-39518a949cb6",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "clm:d9ea0d74-0697-4b33-ba56-14f5a8622621",
      "relationship_type": "affected-organization",
      "source_ref": "x-ally-legal-proceeding--555bd480-cecc-5b04-829e-ce10c9933c01",
      "target_ref": "identity--1ac6582d-4c9c-53bd-8d96-7391f4021499",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Office of the Australian Information Commissioner",
          "url": "https://www.oaic.gov.au/privacy/privacy-assessments-and-decisions/privacy-decisions/Investigation-inquiry-reports/report-into-preliminary-inquiries-of-qantas",
          "external_id": "cit:4acfa788-cda8-4a9d-b88e-f12ce4abe717",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:dcc1461f8212afa32672611cc20a3310124e3d37168324a7d7a3e6f444bbf53b"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e82f7770-feeb-5339-86f4-876c5117c700",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "clm:87c2d04e-b89f-499a-9bc7-1cac80063637",
      "relationship_type": "exposed-data-category",
      "source_ref": "x-ally-data-exposure--591b8c27-73a2-5489-8955-5d193e43a13f",
      "target_ref": "x-ally-data-category--8a4b38eb-4642-521b-8ce5-b7722d526458",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Office of the Australian Information Commissioner",
          "url": "https://www.oaic.gov.au/privacy/privacy-assessments-and-decisions/privacy-decisions/Investigation-inquiry-reports/report-into-preliminary-inquiries-of-qantas",
          "external_id": "cit:b5748635-462a-4954-9b59-af9161a0561b",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:dcc1461f8212afa32672611cc20a3310124e3d37168324a7d7a3e6f444bbf53b"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--00171cae-34ab-5581-8d27-9b84496ccac0",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "clm:5ae7d47e-abbf-43c8-b02e-38acada47bf8",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Office of the Australian Information Commissioner",
          "url": "https://www.oaic.gov.au/privacy/privacy-assessments-and-decisions/privacy-decisions/Investigation-inquiry-reports/report-into-preliminary-inquiries-of-qantas",
          "external_id": "cit:ed0e6a5b-a1da-48b6-9727-63978b3933b5",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:dcc1461f8212afa32672611cc20a3310124e3d37168324a7d7a3e6f444bbf53b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The OAIC emphasized that it had not conducted a full Commissioner-initiated investigation, made no concluded findings, and did not present the report as a broader endorsement of Qantas's compliance."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--0ab653ec-6cf2-5ead-880f-b557b5c601d7",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "clm:0cb829c1-e709-4cf9-8c99-3def97f74bc4",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Office of the Australian Information Commissioner",
          "url": "https://www.oaic.gov.au/privacy/privacy-assessments-and-decisions/privacy-decisions/Investigation-inquiry-reports/report-into-preliminary-inquiries-of-qantas",
          "external_id": "cit:08f197fe-e8b6-4b92-9b09-5660c2f2953f",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:dcc1461f8212afa32672611cc20a3310124e3d37168324a7d7a3e6f444bbf53b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "During the OAIC inquiries, Qantas reported no evidence of further or ongoing threat-actor activity on the CRM platform."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--218a9e23-24d8-5881-85f2-b8df10591028",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "clm:d1499fdf-de47-4252-bc06-85161348e1d7",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Office of the Australian Information Commissioner",
          "url": "https://www.oaic.gov.au/privacy/privacy-assessments-and-decisions/privacy-decisions/Investigation-inquiry-reports/report-into-preliminary-inquiries-of-qantas",
          "external_id": "cit:c65090c2-a4d8-4f0d-884f-589e178bad1c",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:dcc1461f8212afa32672611cc20a3310124e3d37168324a7d7a3e6f444bbf53b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Qantas activated crisis management, engaged legal and forensic specialists, and provided additional social-engineering training after the incident."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--259f9860-e44f-583a-8c18-d79dd78a5a4a",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "clm:0a53d04a-77b4-4c92-b2cd-6aceb99baafc",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Office of the Australian Information Commissioner",
          "url": "https://www.oaic.gov.au/privacy/privacy-assessments-and-decisions/privacy-decisions/Investigation-inquiry-reports/report-into-preliminary-inquiries-of-qantas",
          "external_id": "cit:2fc061b2-bb97-42f0-a1d9-cdf03674aa75",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:dcc1461f8212afa32672611cc20a3310124e3d37168324a7d7a3e6f444bbf53b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The agent's authorized CRM instance was connected through legitimate interactions to a data-extraction tool operated by the threat actor."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--2a17fc11-4c5e-5a05-8cd4-1fb73f2bcdca",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "clm:fac1b487-1320-4aab-84a8-86be750fa714",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Office of the Australian Information Commissioner",
          "url": "https://www.oaic.gov.au/privacy/privacy-assessments-and-decisions/privacy-decisions/Investigation-inquiry-reports/report-into-preliminary-inquiries-of-qantas",
          "external_id": "cit:ac6cdbb6-9e09-4daa-9ef0-41a12aa00a36",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:dcc1461f8212afa32672611cc20a3310124e3d37168324a7d7a3e6f444bbf53b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "On or around 9 July 2025, Qantas notified impacted customers of the specific categories of personal information involved."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--2b32f7e6-1030-51a2-8dad-914c5f425f6f",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "clm:d0ddd33d-f727-4841-a3f4-344034c1be08",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Office of the Australian Information Commissioner",
          "url": "https://www.oaic.gov.au/privacy/privacy-assessments-and-decisions/privacy-decisions/Investigation-inquiry-reports/report-into-preliminary-inquiries-of-qantas",
          "external_id": "cit:50ef6db8-c624-4f76-94a2-e58bf30c9a17",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:dcc1461f8212afa32672611cc20a3310124e3d37168324a7d7a3e6f444bbf53b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2025-06-30"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--2e426fb1-bd99-513d-8bf5-46782e08d907",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "clm:e3cecacf-03bb-4e39-8b3e-272a41f21971",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Office of the Australian Information Commissioner",
          "url": "https://www.oaic.gov.au/privacy/privacy-assessments-and-decisions/privacy-decisions/Investigation-inquiry-reports/report-into-preliminary-inquiries-of-qantas",
          "external_id": "cit:8936d7b5-1dc4-4c36-8987-0481638f4ed3",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:dcc1461f8212afa32672611cc20a3310124e3d37168324a7d7a3e6f444bbf53b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The compromised CRM platform was used by an overseas contact centre operated by an unnamed third-party provider contracted by Qantas."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--3411d0fb-07de-57eb-82a8-314ae1ef2dd6",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "clm:a0cd2c8f-9961-40c4-9c05-e93624b111c9",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Office of the Australian Information Commissioner",
          "url": "https://www.oaic.gov.au/privacy/privacy-assessments-and-decisions/privacy-decisions/Investigation-inquiry-reports/report-into-preliminary-inquiries-of-qantas",
          "external_id": "cit:d8940462-eab1-4a60-91ad-ca1d3a73875a",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:dcc1461f8212afa32672611cc20a3310124e3d37168324a7d7a3e6f444bbf53b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2025-07-11"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--5841d798-4871-50a2-82eb-4e6ebcfc7e17",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "clm:6d1941e4-8aa2-4c4b-834a-b9b76f9c0449",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Office of the Australian Information Commissioner",
          "url": "https://www.oaic.gov.au/privacy/privacy-assessments-and-decisions/privacy-decisions/Investigation-inquiry-reports/report-into-preliminary-inquiries-of-qantas",
          "external_id": "cit:4413ab83-2efb-4990-8bdf-707d09e2f7a7",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:dcc1461f8212afa32672611cc20a3310124e3d37168324a7d7a3e6f444bbf53b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2025-06-28"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--599649b1-98a5-5260-8946-31c598d8cd36",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "clm:5e05ee3e-95f0-478c-8425-7bdb57060e08",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Office of the Australian Information Commissioner",
          "url": "https://www.oaic.gov.au/privacy/privacy-assessments-and-decisions/privacy-decisions/Investigation-inquiry-reports/report-into-preliminary-inquiries-of-qantas",
          "external_id": "cit:cc00c988-24dd-4548-850e-a3f1488b63d3",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:dcc1461f8212afa32672611cc20a3310124e3d37168324a7d7a3e6f444bbf53b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "number",
        "value": 5120000,
        "unit": "individual",
        "approximate": true
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--5d59b15f-062c-5b31-803d-d7de5ce25312",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "clm:cbfafed5-d70f-4678-a234-138d9c5ffe6f",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Office of the Australian Information Commissioner",
          "url": "https://www.oaic.gov.au/privacy/privacy-assessments-and-decisions/privacy-decisions/Investigation-inquiry-reports/report-into-preliminary-inquiries-of-qantas",
          "external_id": "cit:4dbe595b-76a5-4905-907d-9a9d47b17450",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:dcc1461f8212afa32672611cc20a3310124e3d37168324a7d7a3e6f444bbf53b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The OAIC closed its preliminary inquiries without commencing a Commissioner-initiated investigation or taking other regulatory action at that time because the available evidence did not point toward a likely APP contravention warranting further investigation."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--7f4a4ff8-e7ce-5b5b-8292-a6e0c830e719",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "clm:9cb6ab5d-1801-4627-8b4c-880561fdec7f",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Office of the Australian Information Commissioner",
          "url": "https://www.oaic.gov.au/privacy/privacy-assessments-and-decisions/privacy-decisions/Investigation-inquiry-reports/report-into-preliminary-inquiries-of-qantas",
          "external_id": "cit:55e101e3-c43f-4f48-8824-aecaa87da997",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:dcc1461f8212afa32672611cc20a3310124e3d37168324a7d7a3e6f444bbf53b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2025-07-02"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--9a7b04d1-06ea-5eed-8b4b-ada459d1a8ca",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "clm:cc5df11a-037f-40f4-b848-1554aa3dc199",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Office of the Australian Information Commissioner",
          "url": "https://www.oaic.gov.au/privacy/privacy-assessments-and-decisions/privacy-decisions/Investigation-inquiry-reports/report-into-preliminary-inquiries-of-qantas",
          "external_id": "cit:d2613ed9-04d1-4915-80e1-9571423b6a48",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:dcc1461f8212afa32672611cc20a3310124e3d37168324a7d7a3e6f444bbf53b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "number",
        "value": 5670000,
        "unit": "record",
        "approximate": true
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--9cb8c8d2-954d-5ce1-8752-68a487dd5991",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "clm:fadc7296-7d74-40ed-a277-ac6577cf329a",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Office of the Australian Information Commissioner",
          "url": "https://www.oaic.gov.au/privacy/privacy-assessments-and-decisions/privacy-decisions/Investigation-inquiry-reports/report-into-preliminary-inquiries-of-qantas",
          "external_id": "cit:9f46a7c6-0dcc-4372-b334-738172b31a98",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:dcc1461f8212afa32672611cc20a3310124e3d37168324a7d7a3e6f444bbf53b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-07-16"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--c6e7bcdc-f98b-5ac2-826b-88372df59fff",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "clm:ff352cef-4566-4e39-b0af-ac45f38ec078",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Office of the Australian Information Commissioner",
          "url": "https://www.oaic.gov.au/privacy/privacy-assessments-and-decisions/privacy-decisions/Investigation-inquiry-reports/report-into-preliminary-inquiries-of-qantas",
          "external_id": "cit:c5e0c8df-4eba-44af-818b-b0fb7d16a458",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:dcc1461f8212afa32672611cc20a3310124e3d37168324a7d7a3e6f444bbf53b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "On 30 June 2025, Qantas froze and revoked access to the associated account, securing the CRM platform and triggering incident-response processes."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--c899b640-5a26-5aff-8a2b-94c1e300c5e4",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "clm:155da586-d731-4bfd-b47a-3a7b32561583",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Office of the Australian Information Commissioner",
          "url": "https://www.oaic.gov.au/privacy/privacy-assessments-and-decisions/privacy-decisions/Investigation-inquiry-reports/report-into-preliminary-inquiries-of-qantas",
          "external_id": "cit:5680bd53-9781-4ec5-96e9-3f4ecad11f50",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:dcc1461f8212afa32672611cc20a3310124e3d37168324a7d7a3e6f444bbf53b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The OAIC reported that the CRM platform did not store credit-card, personal financial, or passport information, and Qantas said passwords, PINs, and login details were not compromised."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--d3673d06-f9a4-5c56-8189-03cd71b52fbf",
      "created": "2026-08-09T18:00:00Z",
      "modified": "2026-08-09T18:00:00Z",
      "x_ally_original_id": "clm:67c2b602-7a7c-4e13-a37a-bc84bd6eba2b",
      "confidence": 95,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1566/004/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--e3d33001-5257-5e4e-8c6f-20ba5d27db4e",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "clm:d22508e6-c6aa-400d-a256-9f9bfaf7c61d",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Office of the Australian Information Commissioner",
          "url": "https://www.oaic.gov.au/privacy/privacy-assessments-and-decisions/privacy-decisions/Investigation-inquiry-reports/report-into-preliminary-inquiries-of-qantas",
          "external_id": "cit:019e8675-4373-4023-957a-ad986d66afd9",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:dcc1461f8212afa32672611cc20a3310124e3d37168324a7d7a3e6f444bbf53b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-06-01"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--ecb991c8-c493-5173-86f6-c103c70b26a5",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "clm:95fed4a9-f847-4287-b64e-47678f4debb5",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Office of the Australian Information Commissioner",
          "url": "https://www.oaic.gov.au/privacy/privacy-assessments-and-decisions/privacy-decisions/Investigation-inquiry-reports/report-into-preliminary-inquiries-of-qantas",
          "external_id": "cit:bf933a15-d145-4513-b67b-65e93466208f",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:dcc1461f8212afa32672611cc20a3310124e3d37168324a7d7a3e6f444bbf53b"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "A caller impersonating Qantas IT deceived an overseas contact-centre agent in a phone-based social-engineering attack, also described as vishing."
      }
    },
    {
      "type": "x-ally-data-category",
      "spec_version": "2.1",
      "id": "x-ally-data-category--40ba6c78-b66b-5dcd-8ee9-5f2789f80585",
      "created": "2026-08-09T01:29:00Z",
      "modified": "2026-08-09T01:29:00Z",
      "x_ally_original_id": "dat:41d26529-cba1-47c1-b528-25e4c18aedb2",
      "name": "Demographic information"
    },
    {
      "type": "x-ally-data-category",
      "spec_version": "2.1",
      "id": "x-ally-data-category--8a4b38eb-4642-521b-8ce5-b7722d526458",
      "created": "2026-08-09T01:12:00Z",
      "modified": "2026-08-09T01:12:00Z",
      "x_ally_original_id": "dat:74c79a35-6d37-461e-b865-805c619d4231",
      "name": "Gender information"
    },
    {
      "type": "x-ally-data-category",
      "spec_version": "2.1",
      "id": "x-ally-data-category--a2b7dd9d-0c02-5710-88ed-ea507d0ffa07",
      "created": "2026-08-08T23:12:00Z",
      "modified": "2026-08-08T23:12:00Z",
      "x_ally_original_id": "dat:559cf3f5-80c7-45ba-a930-ff0bfa8d17b0",
      "name": "Names"
    },
    {
      "type": "x-ally-data-category",
      "spec_version": "2.1",
      "id": "x-ally-data-category--b82a6005-4623-5256-83d6-809edefdbbbe",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "dat:8bc5e6c0-ee96-450a-a50e-f5a90aa454de",
      "name": "Loyalty program information"
    },
    {
      "type": "x-ally-data-category",
      "spec_version": "2.1",
      "id": "x-ally-data-category--c79f34f3-405d-57d2-8409-98eff3898231",
      "created": "2026-08-08T23:12:00Z",
      "modified": "2026-08-08T23:12:00Z",
      "x_ally_original_id": "dat:5abcee7e-4a37-494a-b6ba-87ff46149be9",
      "name": "Contact information"
    },
    {
      "type": "x-ally-data-category",
      "spec_version": "2.1",
      "id": "x-ally-data-category--ff2c8174-4feb-535f-8a4d-be23ee26eff2",
      "created": "2026-08-08T23:12:00Z",
      "modified": "2026-08-08T23:12:00Z",
      "x_ally_original_id": "dat:ad54319a-bb47-40fb-be6c-7fd6e2aa1f68",
      "name": "Dates of birth"
    },
    {
      "type": "x-ally-data-exposure",
      "spec_version": "2.1",
      "id": "x-ally-data-exposure--591b8c27-73a2-5489-8955-5d193e43a13f",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "exp:9e2c04e4-59f4-46d9-b9cb-03eb3f707145",
      "name": "Qantas customer CRM data exposure"
    },
    {
      "type": "x-ally-jurisdiction",
      "spec_version": "2.1",
      "id": "x-ally-jurisdiction--a0752c9c-6223-54ee-816f-c2702837f0dc",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "jur:e7214555-1d01-4b3a-93a6-d2bdf2c64942",
      "name": "Australia"
    },
    {
      "type": "x-ally-legal-proceeding",
      "spec_version": "2.1",
      "id": "x-ally-legal-proceeding--555bd480-cecc-5b04-829e-ce10c9933c01",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "lgl:75dd840f-5ab4-4f25-a3c4-c48db8e6a432",
      "name": "OAIC preliminary inquiries into Qantas"
    },
    {
      "type": "x-ally-notification",
      "spec_version": "2.1",
      "id": "x-ally-notification--9846eb65-8fa1-5385-8e27-095397f46a24",
      "created": "2026-08-09T02:11:22Z",
      "modified": "2026-08-09T02:11:22Z",
      "x_ally_original_id": "ntf:02644b35-f3ca-4a46-8fff-bdc6608f812d",
      "name": "Qantas impacted-customer notifications"
    }
  ]
}