The federal government is holding to its position that it will not negotiate with cyber criminals or pay ransoms, after a hacking group followed through on its threat to release stolen Qantas data.
Qantas was targeted in July, when 40 global firms, linked to the cloud software giant Salesforce, had data stolen.
After the hackers' deadline for a ransom payment passed on Saturday, they released the data on the dark web.
The attack involved the personal data of 5.7 million Qantas customers.
For most of its customers, the data stolen was limited to name, email address and frequent flyer details.
Some customers' data included address, date of birth, phone number and gender, but Qantas says no credit card details were impacted.
In a statement released online on their Telegram channel on Saturday, the cybercrime collective Scattered Lapsus$ Hunters were scathing of the Australian government.
It posted "change your laws, change your policies, change something, we will endlessly attack you till you eventually rewrite your own rules".
The hackers threatened that they have the resources to continue these types of attacks and encouraged others to target Australia.
The Australian government maintains a strict policy of not paying ransoms in response to cyber extortion.
Hackers are 'relentless'
Transport Minister Catherine King said on Sunday that she was one of the Australians whose data had been released on the dark web.
"I don't think Australia needs to change its ways, but we obviously need to constantly adapt because these people are smart, they are relentless and they are after our data all of the time," she said.
Ms King put the onus on companies and individuals to be vigilant.
"It is incumbent on agencies that have this data to protect it as strongly as they possibly can," she said.
Ms King advised Australians to change their passwords, enable two-factor verification and never click on links in emails from unknown sources.
Federal Attorney-General Michelle Rowland said the government was committed to uplifting privacy laws and had already made progress, pointing to the Australian Information Commissioner's improved powers to respond to data breaches and increased penalties for companies that fail to adequately protect customer data.
The Information Commissioner would not comment on whether Qantas would be fined over the breach.
Qantas has confirmed it was investigating dark web channels to verify what information had been leaked and that it was working with the federal government and police.
Qantas said it would continue to share updates on its website and customers could call its 24/7 support line on 1800 971 541 or +61 2 8028 0534 for ongoing access to specialist identity protection services.
