Just trust us – we’re Qantas 

In a deficit of goodwill, consumer trust, and transparency, Qantas’ communications department is now attempting to fly through major turbulence as it responds to a significant cyber attack. 

When facing an issue with significant unknowns but potential for considerable concern and harm, organisations should always err on the side of providing more information rather than less. Even without definitive answers, keeping customers and stakeholders informed about when further updates are expected and acknowledging that questions remain while actively working to address them helps manage expectations and demonstrates your understanding of stakeholder concerns. 

Unfortunately, this doesn’t seem to be the path chosen by Qantas following the news that nearly six million customers may have had their records compromised in a recent cyber attack. 

Qantas made the wise decision of creating a dedicated page on their website for the issue, with clear sections including summaries and FAQs. This allows people to access as much or as little detail as they want. The airline has also committed to updating this page as more information becomes available. 

However, in their initial response, several critical questions remained unaddressed: 

Communication clarity and frequency

Qantas has committed to updating its dedicated webpage as more information becomes available, but this still leaves customers wondering how often they should check it for updates. They also stated they’re contacting affected customers, but they didn’t specify the communication method or timeline. And with there now being apprehension about the legitimacy and authenticity of messages from Qantas, as bad actors may choose to take advantage of the situation, this is a big misstep. Overnight, Qantas sent a well-executed email, but the previous information gaps brought avoidable confusion.

And while Qantas did provide a phone number that concerned customers could call, most would know that doing so would result in lengthy hold times, making it an impractical and potentially frustrating solution for most customers seeking immediate answers.

Customer action guidance

What specific steps should customers take to protect their data? Should they monitor their frequent flyer accounts more closely? Change their login details? How can customers determine if their data has been compromised? These are all the questions that customers will be thinking about. Qantas should have already anticipated these questions and addressed them as best as they could in the initial communication. Even if definitive answers weren’t yet available, they needed to address this directly and clearly, or risk frustrating and upsetting customers even more.

If Qantas were actively listening to what’s being said in the media, on social media, and likely on their own hotlines, they would notice misunderstandings that could be corrected on their dedicated information page. Listening informs your response strategy, helping you stay proactive and to limit misinformation. 

Security implications

Customers need clarity on potential consequences for their personal security. Could the stolen data facilitate identity theft or targeted scams? This information is crucial for helping people understand their risk exposure and how concerned and alert they should be about the repercussions. 

System security assurance

 One of the first things Qantas should have done is clarify the extent of the cybersecurity breach and the systems that were compromised. For instance, if this breach resulted from a third-party supplier vulnerability rather than Qantas’s own systems, explaining this distinction would provide valuable context. A more complete picture helps affected parties better understand their concerns while reducing customer anxiety and frustration. Some of this came much later in the email to customers, but a whole news cycle had passed by then.

Phoebe Netto

Missing the communication runway 

The initial absence of answers to these questions created unnecessary speculation and confusion, consuming more organisational resources and causing additional chaos. This information vacuum led to mainstream media coverage featuring expert speculation about the impact of the breach and conflicting advice about customer precautions, which only further damaged the relationship with customers and stakeholders. That expert should have been Qantas, leaving less room for other voices. 

Qantas has since sent a direct letter to customers that was clear, appropriately empathetic, and addressed many of the core questions that had been left unanswered by their initial communications. The letter included reassuring details and demonstrated a more comprehensive understanding of customer concerns. However, this communication came much later than it should have – after a full news cycle had already taken hold without sufficient information from the airline itself. This timing meant that the story had gotten away from them, with the bulk of media reports containing conflicting advice from external experts and breeding avoidable confusion. 

While the letter gives media a second opportunity to report on the issue – and thankfully it is a well-crafted communication – the insufficient initial response meant that much of the narrative had already been shaped by external voices rather than Qantas taking control of the story from the outset. 

The modern issues management and crisis communication approach has evolved significantly from the old school practices, when organisations were advised to provide minimal information with no emotion or human element, aiming to reduce media coverage by offering little for journalists to work with. 

However, today’s landscape demands a different strategy: limiting information can be as damaging as a misstep. People expect transparency, empathy, and accountability, which requires a delicate balance between informing the public and protecting your organisation’s reputation. 

From the moment this issue came to light, Qantas should have provided an authoritative source of truth to speak about the situation. This spokesperson serves one of the most fundamental roles of issues management: providing customers with sufficient detail to minimise their need to seek answers elsewhere. 

Once immediate concerns are addressed, Qantas will need to provide more comprehensive answers about how access to this data was gained, detection timelines, the changes they will implement, and whether they have severed any vendor relationships as a result of the breach. 

While Qantas’s subsequent letter to customers demonstrated they could provide the transparency and detail that stakeholders needed, it came too late in the crisis timeline.

For the questions that can’t be immediately answered, the airline should provide a regular communication schedule for ongoing updates, even if those updates confirm they’re still working to obtain certain information. For example, committing to posting updates every hour or at specific times, such as 3pm and 6pm daily, prevents customers from feeling uncertain about whether or when they’ll receive crucial information. 

Qantas needed to reassure customers and shareholders in a manner that projected confidence and encouraged calm, rather than leaving room for speculation and heightened concern. More information, increased communication, and listening were required here – especially when the airline has already nosedived from being one of Australia’s most trusted brands to being among the most distrusted.  

Related Content

News Qantas confirms customer data stolen in 'significant' cyber attack

News Coles launches budget-friendly 'Simply' range to win back consumer trust