Qantas CEO pays the price for cyberattack
Qantas has deducted $250,000 from its chief executive Vanessa Hudson’s bonus following a cyberattack that affected millions of customers.
Image by Jenny Evans/Getty Images
Follow us
Qantas has deducted $250,000 from its chief executive Vanessa Hudson’s bonus following a cyberattack that affected millions of customers.
Hudson will still take home over $6 million in overall remuneration for the 2025 financial year, but had her short-term bonus reduced over the breach that the Australian airline detected in June.
The cut equates to 15% of her bonus, a reduction that the Qantas board also applied to the rest of the executive team, despite the company reporting a $2.39 billion underlying profit for the year.
“Despite the strong performance, the board decided to reduce annual bonuses by 15 percentage points as a result of the impact the cyber incident had on our customers,” said Qantas Group Chairman John Mullen.
“This reflects their shared accountability, while acknowledging the ongoing efforts to support customers and put in place additional protections for customers,” Mullen said.
The company said it had an “outstanding” year, which means the penalty will leave little dent on the executives’ financial assets.
For example, chief executive Hudson received $6.3 million in remuneration for this financial year, up 43% from the $4.4 million received a year prior.
This is because Qantas shares performed particularly well under her tenure, more than doubling from $4.47 three years ago when Hudson took over to $10.74 as of June 30th.
What was the Qantas breach about?
Qantas detected the breach on June 30th when the airline said a “cyber criminal targeted a call centre to gain access to a third-party customer servicing platform.”
Six million customers were affected by the cyberattack, with their names, email addresses, phone numbers, dates of birth, and frequent flyer numbers exposed as a result.
The breach targeted a third-party platform used by Qantas contact center and the airline’s operations were not affected, the company said at the time.
It also said that the affected data did not include credit card details, personal financial information, or passport details.
