Blog

Hackers leaked the personal records of five million Qantas customers on the dark web on Saturday afternoon, according to a cybersecurity expert, after a ransom deadline set by the cybercriminals passed.

The company is one of more than 40 firms globally caught up in the hack, reported to contain up to 1bn customer records.

The hacker collective Scattered Lapsus$ Hunters released an extortion note on a data leaks site on the dark web last week, demanding payment in return for preventing the stolen data from being shared.

The Qantas data, which was stolen from a Salesforce database in a major cyber-attack in June, included customers’ email addresses, phone numbers, birth dates and frequent flyer numbers. It did not contain credit card details, financial information or passport details.

On Saturday the group leaked the data, writing: “Don’t be the next headline, should have paid the ransom.”

_{Sign up: AU Breaking News email}

Jeremy Kirk, the executive editor of Cyber Threat Intelligence, said 44 companies had been included in the leak including, Gap, Vietnam Airlines, Toyota, Disney, McDonald’s, Ikea, and Adidas.

He said the hacker group was well known and operated out of countries like the US, UK and Australia.

“This particular group is not a new threat; they’ve been around for some time,” Kirk said. “But they’re very skilled in knowing how companies have connected different systems together.”

A Qantas spokesperson previously told Guardian Australia its priorities were “continued vigilance and providing ongoing support for our customers” after the June attack.

“We continue to offer a 24/7 support line and specialist identity protection advice to affected customers,” the spokesperson said.

A Salesforce spokesperson told Guardian Australia the company “will not engage, negotiate with, or pay any extortion demand”.

There was no indication the Salesforce platform had been compromised, the company said via a statement.

“We are aware of recent extortion attempts by threat actors, which we have investigated in partnership with external experts and authorities. Our findings indicate these attempts relate to past or unsubstantiated incidents, and we remain engaged with affected customers to provide support,” it said.

It is understood the global data was stolen between April 2024 and September 2025 and includes personal and contact information of the companies’ customers and employees, including dates of birth, purchase histories and passport numbers.

“No company wants to see, you know, hundreds of thousands, or, millions of records of their customers just on the internet,” Kirk said. “That’s awful. It’s awful for the companies. It’s awful for the people affected.”

In July, Qantas obtained an ongoing injunction from the NSW supreme court ensuring protections to prevent the stolen data being accessed, viewed, released, used, transmitted or published by anyone, including third parties.

Kirk said there was no financial data but criminals could potentially use leaked personal information to open credit cards. He said people should monitor their accounts for suspicious activity, and beware of scam emails that are personalised.

“These days, a lot of threat groups are now generating personalised phishing emails,” he said. “They’re getting better and better at this – and these types of breaches help sort of fuel that economy, that underground fraudster economy.”

Qantas has been contacted for comment.

An online parallel market for an unlicensed weight-loss drug is being fuelled by TikTok fitness influencers and sellers on WhatsApp, a Guardian investigation can reveal.

Retatrutide, which is still in clinical trials, is being advertised by social media influencers for its supposed fat-burning effects. Followers are urged to message the accounts privately for supplier links, as well as being provided with discount codes.

Separately, there is a thriving trade on Telegram, where groups with thousands of members share “before and after” photos, injection guides and claims of next-day UK delivery. Sellers advertise the drug there before directing customers to WhatsApp for transactions.

Retatrutide is an experimental injection developed by the US drugmaker Eli Lilly. The drug targets three gut hormones – GLP-1, GIP and glucagon. Early trials suggest it could help patients lose up to a quarter of their body weight. Nicknamed the “triple G”, the drug is being hailed online as the next Ozempic.

However, doctors and pharmacists have warned that the sale of what is still an unlicensed drug in the UK is a cause for concern and could result in users injecting products of unknown origin.

Some said the popularity of retatrutide could be linked to the rising cost of licensed weight loss products such as Mounjaro.

Selling retatrutide on TikTok or Telegram is illegal in the UK, as it is an unlicensed drug that cannot be marketed or supplied for human use under the Human Medicines Regulations 2012.

Some influencers try to sidestep the rules by referring to the drug as a “research chemical” or citing it as “not for human consumption”. Retatrutide is not a controlled drug, but promotion and supply can still breach medicines, advertising, and consumer laws, risking fines, prosecution or prison.

The TikTok influencer Jon Kluth, who is based in the US and has 226,500 followers, posted on the 26 June an update on his journey taking what he called “reta” for four weeks and that said followers could use “code Jon” to purchase it. He then links to an account that sells peptides called Halfnattys. When asked for a comment, Kluth did not respond and the account was taken down.

Another account with a UK influencer called @MappyMyGains talks about retatrutide as a “gamechanger” on 21 September, and when followers ask where he gets the drug from he says “pm me mate”. He did not respond to a request for a comment.

Another promoter called @clairejoy86 posted videos captions “day 10 of Reta … ” to the background track of the song Manchild by Sabrina Carpenter. Those who comment are told to message her for supply information. She did not respond to a request for comment and instead the account was taken down.

According to TikTok, the social media company has removed violative content and banned associated hashtags and search suggestions. It said it was dedicated to keeping the platform safe and invest in strengthening enforcement strategies.

The Guardian also found groups with up to 9,000 members selling retatrutide using Telegram’s built-in discovery tool, which works like a public directory. Typing “retatrutide” instantly brings up channels with thousands of members, filled with photos of weight loss, glowing testimonials and step-by-step guides for mixing or injecting at home.

Within minutes of joining one group, a seller posted WhatsApp details, where most transactions take place. The seller sent an instruction manual and promised delivery within 48 hours. When asked whether the product was genuine, one seller said: “You can’t be sure.” Another shared a photo of a supposed laboratory certificate. None asked about weight, medical conditions or previous experience.

Inside these groups, posts show black plastic parcels with Royal Mail labels, claiming to contain new batches. One message read: “It took eight of us to load them this morning.”

Buyers can choose between powder vials, mixed at home with sterile water, or pre-filled pens typically sold at £160 for 20mg. When asked how long a pen should last, sellers give conflicting answers ranging from a few weeks to “depends on your body”.

A spokesperson for Telegram said it actively moderated harmful content on its platform including content that encouraged the “misuse of controlled medications”. It added that it removed “millions of pieces of harmful content each day”.

Jason Murphy, the head of pharmacy at Chemist4U, said unregulated imports could be dangerous. “People are injecting substances they can’t verify. Even if the science behind retatrutide is sound, these online versions may not contain what they claim,” he said.

Dr Crystal Wyllie of Asda Online Doctor linked the surge in demand to recent price rises for approved weight-loss drugs such as Mounjaro. “With costs increasing, patients are turning to social media. But counterfeit injections are extremely risky. You can’t be certain what’s inside or whether the environment they were made in was sterile,” she said.

Her team has already seen patients harmed by self-injection from unverified sources. “We understand the frustration, but buying from Telegram or WhatsApp is gambling with your health,” said Wyllie. “These substances could be contaminated or incorrectly dosed.”

A spokesperson from Eli Lilly said retatrutide was in phase 3 clinical trials and had not been reviewed or approved by any regulatory agency anywhere in the world. “Therefore at this time no one can sell [it] for human use,” they said, adding that any product “falsely representing itself as a Lilly investigational product not yet approved … may expose patients to potentially serious health risks”.