The Australian Computer Society (ACS) has called for stronger scrutiny of technology supply chains and cyber preparedness after a cyber incident involving Qantas technology supplier Amadeus, arguing it raises “urgent questions” about Australia’s data sovereignty and the resilience of essential services.
In a statement dated 3 November 2026, ACS CEO Dr Prins Ralston said Australians “deserve confidence that the information they entrust” to the national carrier is protected across its technology supply chain.
Ralston pointed to Qantas’ public position that its own systems “remain secure” and that it is assessing whether bookings were affected, and argued the incident should be treated as part of a broader pattern of cyber risk. He also referenced breaches affecting Medicare, saying the central question is “how many warnings does Australia need before taking stronger control of its digital security?”
He cited statistics from the Australian Signals Directorate’s Cyber Security Centre, which he said responded to more than 1,500 incidents in 2025–26, a 20% increase, and warned of state-sponsored actors accessing networks for intelligence collection and potential future disruption. “The stakes extend well beyond stolen data,” he said.
According to ACS, the incident underlines the need for more demonstrable assurance that critical services can withstand disruption. “We cannot wait for essential services to fail before demanding evidence that their protections work,” Ralston said, calling for independent testing, clearer accountability and demonstrated capability among those tasked with securing and assessing key systems.
Ralston also linked cyber resilience to workforce capability, noting ACS’ view that Australia has resident technology professionals whose skills have been independently assessed against the Skills Framework for the Information Age (SFIA). He said employers should use verified capability when appointing people to secure and assess critical systems, and where workforces have not been independently assessed, organisations should verify capability, identify gaps and provide training.
ACS’ statement referenced its Digital Pulse 2026 report, which forecasts Australia will need another 259,000 technology workers by 2035, and argued meeting that demand will require broader pathways into the profession, practical skills training and “clear standards so employers can verify capability”.
It also highlighted the ACS-led CyberPath pilot, which it said has been informed by more than 2,000 engagement touchpoints across the cyber community. Ralston said government, industry and employers should embed standards in how they recruit, select providers and assess cyber security work.
“Digital sovereignty depends on our ability to protect our information and keep essential services operating under pressure,” Ralston said. “Australians deserve more than another investigation and another apology.”
