Scattered Spider summer-2025 airline-sector wave: WestJet, Hawaiian, Qantas
Native-English-speaking financially-motivated crew, assessed to include members in the United States, United Kingdom, and Canada. Tradecraft centers on SIM-swap and voice-phishing of IT helpdesks to…
Summary
Two months after the April 2025 UK retail-sector wave, Scattered Spider operators pivoted to the aviation industry during the Northern-Hemisphere peak travel season. Confirmed compromises: **WestJet** (initial access 13 June, 1M+ customer records affected), **Hawaiian Airlines** (June 2025), and **Qantas** (third-party contact-centre platform, 30 June 2025; up to 6M passenger PII records exposed). Operationally identical to the M&S / Co-op wave: voice-phishing of help-desk and contact-centre staff, MFA-bypass through device- enrolment, supplier / SaaS pivot. The FBI issued a sector-specific advisory on Scattered Spider's airline targeting in late June 2025.