Australians could be at serious risk if data stolen during a worldwide cyberattack is used to steal identities and accrue debts in their name, a cyber security expert has warned.

About 40 major companies including Toyota, Disney, Ikea and Qantas were reported to have been caught up in the theft of about one billion individual records from technology giant Salesforce.

Hacker collective Scattered Lapsus$ group has since given affected companies until Friday to begin negotiations on a ransom or face “massive consequences”.

It is understood the stolen data was taken between April 2024 and September 2025 and includes dates of birth, passport numbers and purchase histories.

Such stolen data can create major headaches for victims if it is sold online, KordaMentha forensic and cybersecurity

See Full Page