A major cyberattack exposed data of about five million Qantas customers after hackers leaked records online when a ransom deadline expired.