Security notice: 9 August 2026
Published: 9 August 2026
Status: Contained. Offender account terminated, feature suspended.
It is genuine. We emailed everyone who received the scam message to warn them. Our warning came from bishal@onebookplus.com.au, contains no links, and asks you for nothing.
The scam email you should delete has the subject "Your Qantas credit is ready to claim" and appears to come from "E-QANTAS Rewards". It is not from Qantas. Do not open the link in it.
Early on Sunday 9 August 2026, someone created a free trial account on OneBookPlus, uploaded a stolen mailing list, and used our email campaign feature to send Qantas-impersonation phishing before we detected and stopped it.
146 messages reached inboxes. The offender's account was banned within two hours of the send, and bulk campaign sending was suspended across the entire platform shortly after.
No customer data was accessed, disclosed or lost. The offender created their own account and could only ever see their own data. No OneBookPlus customer's invoices, contacts, bookings or financial records were touched. There was no compromise of our systems, our credentials or our mail provider.
This is not a notifiable data breach under the Privacy Act 1988, and no notification to the OAIC is required.
Our campaign feature built the email sender name from the tenant's own business name, without validating it. The offender named their business "E-QANTAS Rewards", so that is what recipients saw, sent from our authenticated domain with valid SPF, DKIM and DMARC.
That is our fault. Spam filters had no reason to stop it.
- Banned the account, destroyed its session, and deactivated the tenant
- Suspended bulk campaign sending platform-wide
- Reported both scam URLs to Google Safe Browsing, Microsoft and Netcraft
- Lodged takedown requests with both domain registrars
- Self-reported to our email provider
- Notified the security teams of every organisation whose staff received the message
- Individually warned all 146 recipients
- Lodged reports with ReportCyber, which referred the matter to Victoria Police, and with ACCC Scamwatch
- Sender name validation. Business names that impersonate banks, government bodies, airlines or major brands can no longer be used as an email sender name.
- Campaigns off free trials. Trial accounts get a hard recipient cap; bulk sending requires a paid plan.
- Bulk import limits. Contact imports are rate limited and capped.
- Detection. Automated alerting on high-volume activity from new accounts. We found this incident by noticing it, which is not good enough.
Bulk campaign sending stays suspended until these are in place.
Email bishal@onebookplus.com.au. If you received the scam message and want to know exactly what was sent to you, ask and we will tell you.
To report a security issue, see our responsible disclosure policy.
Questions about this notice
- I received an email from OneBookPlus warning me about a Qantas scam. Is it genuine?
- Yes. On 9 August 2026 OneBookPlus emailed every person who received the scam message, from bishal@onebookplus.com.au, to warn them. That warning email contains no links and asks for nothing. If you received it, it is genuine. The original scam email, with the subject "Your Qantas credit is ready to claim", is not from Qantas and should be deleted.
- Was OneBookPlus customer data accessed in this incident?
- No. No OneBookPlus customer data was accessed, disclosed or lost. The offender created their own trial account and could only ever see their own data. This was not a breach of OneBookPlus systems and is not a notifiable data breach under the Privacy Act 1988.
- How did scam emails pass spam filters if they came from OneBookPlus?
- The messages were genuinely sent through the OneBookPlus mail system by an account abusing the platform, so they carried valid SPF, DKIM and DMARC authentication. Recipient spam filters had no signal to reject them. The underlying cause was that a tenant's business name was used as the email sender name without validation, which allowed the offender to present as a well-known brand.
- What has OneBookPlus changed to prevent this?
- OneBookPlus suspended bulk campaign sending platform-wide within hours of detection, and is shipping sender-name validation that blocks impersonation of banks, government bodies and major brands, a recipient cap on trial accounts, rate-limited bulk contact import, and automated alerting on high-volume activity from new accounts.