What We Know About Scattered Spider, the Hacking Group Targeting Airlines
Alarm bells are ringing over a hacking group known as Scattered Spider, which is now believed to be focusing its attacks on the airline industry. Over the weekend, alerts were issued by the FBI, Google, and cybersecurity firm Palo Alto Networks warning of suspicious activity in the aviation and travel sectors—activity that matches the group’s known methods.
Qantas Data Breach Likely Tied to Scattered Spider
On Monday, Qantas disclosed a cyber attack that compromised data from 6 million customer accounts. The airline did not confirm if Scattered Spider was responsible, but cybersecurity analysts say the attack bears the hallmarks of the group’s tactics. Stolen data included names, contact information, birth dates, and frequent flyer numbers—though credit card and passport details were not affected.
Qantas CEO Vanessa Hudson apologised for the breach and the uncertainty it caused. The incident is under investigation, and Qantas has reported it to relevant cybersecurity authorities.
Who Is Scattered Spider?
Also known by aliases like UNC3944, Octo Tempest, Muddled Libra, and Scatter Swine, Scattered Spider is an aggressive and loosely organized hacking group believed to be composed mainly of young, English-speaking individuals in the US and UK, some reportedly as young as 16.
Since emerging in 2022, the group has launched over 100 cyber attacks on sectors ranging from telecommunications and finance to gaming and retail. In 2023, it made headlines after breaching MGM Resorts and Caesars Entertainment, disrupting operations in major casinos worldwide.
In the UK, the group has hit retail giants such as Marks & Spencer, Harrods, and Co-Op, with the attack on M&S alone reportedly causing up to £300 million ($600 million AUD) in lost operating profits.
Tactics and Methods
Scattered Spider is known for using social engineering, manipulating employees—often through impersonation—to gain access to internal systems. Their tactics include:
- Phishing and fake phone calls to IT helpdesks
- MFA (multi-factor authentication) bombing, overwhelming users with login requests until one is mistakenly approved
- Exploiting third-party vendors and contractors, who may have weaker cybersecurity protocols
Professor Daswin De Silva from La Trobe University described their techniques as “highly manipulative,” exploiting gaps in communication between outsourced helpdesks and core business operations.
Cybersecurity expert David Tuffley added, “They know how to speak the right language to get people to do what they want,” referring to the group’s convincing impersonations.
A Broader Threat to the Airline Industry
The FBI recently warned that Scattered Spider has shifted its focus to the aviation sector, targeting not only airlines but also contractors and IT service providers within the industry ecosystem. Hawaiian Airlines and WestJet have both reported recent cyber incidents, though it’s unclear if they were linked to the group.
What Happens With Stolen Data?
According to experts, stolen data from such breaches is often used in ransom attempts, identity theft, or sold on the dark web. By combining data from various breaches, hackers can impersonate individuals to:
- Hijack SIM cards (SIM swapping)
- Commit financial fraud
- Reset passwords or bypass security checks
Professor Tuffley warned that detailed personal data increases the risk of successful impersonation. Professor De Silva also criticized the 48-hour delay between Qantas detecting the attack and notifying the public, saying that such lags allow for further targeted attacks based on stolen data.
What Should Customers Do?
Customers are advised to:
- Monitor their frequent flyer and financial accounts for unusual activity
- Avoid reusing passwords
- Enable multi-factor authentication on important accounts
Authorities continue investigating the Qantas breach, while cybersecurity experts emphasize the growing need for stronger communication and protection strategies following major cyber incidents.
