Data breaches at Qantas and Discord potentially impact Hong Kong customers

The Office of the Privacy Commissioner for Personal Data has announced it is investigating a data breach at Qantas Airways after receiving a notification from the airline. 

The incident, which occurred at a third-party service provider for the airline, initially compromised the data of approximately 570 million customers globally. Preliminary information suggests this event has affected about 20,000 customers in Hong Kong.

The exposed data is reported to include a wide range of personal details such as names, genders, dates of birth, addresses, email addresses, and phone numbers. 

More sensitive information, including health details, frequent flyer numbers, meal preferences, and requests for special assistance, may also have been accessed. 

Qantas has begun notifying the affected individuals and is expected to provide a more detailed report to the Privacy Commissioner's office later this month. The watchdog is also seeking to determine if any of this data has been leaked onto the dark web.

In a separate and unrelated incident, the privacy watchdog has initiated a compliance review into a data breach involving the platform Discord. 

The office acted after the company publicly disclosed that its own third-party customer service provider was hacked but did not receive a direct notification from the platform.

The Discord breach involved data from users who had contacted its support or trust and safety teams, potentially exposing names, usernames, email addresses, and partial credit card information. It also included identity documents submitted for age verification by approximately 70,000 users globally.

In light of these incidents, the public is urged to remain vigilant against the potential misuse of their personal data. 

Recommended precautions include changing online account passwords and enabling multi-factor authentication, monitoring bank and credit card statements for any unauthorized transactions, and being cautious of suspicious emails or messages. Individuals who suspect their information may have been compromised can contact the Office of the Privacy Commissioner for Personal Data for inquiries or to file a complaint.