Quest Apartment Hotels Investigates Data Breach Impacting Customer Records Quest Apartment Hotels has confirmed a security breach exposing customers' personal data, including full names, email addresses, and contact details. A limited number of records also contained dates of birth. The incident, detected on 17 August 2026, stemmed from unauthorized access to a database via a vulnerability in a third-party service provider. The company acted swiftly to contain the breach and secure affected systems, stating the incident has since been resolved. Quest has notified Australia’s Office of the Australian Information Commissioner (OAIC) and the Australian Cyber Security Centre (ACSC). In a customer email, David Mansfield, Managing Director for Australasia at The Ascott Limited (Quest’s parent company), apologized for the breach and assured customers that further updates would be provided if additional risks were identified. While the exact scale of the breach remains unclear, social media reports indicate affected customers received notifications overnight. Quest operates under The Ascott Limited, which also owns brands like Citadines and Oakwood, with a presence in Australia and globally. The incident follows Origin Energy’s recent disclosure of a breach affecting 900,000 customers, underscoring ongoing cybersecurity challenges in the region. Quest has advised customers to remain cautious of phishing attempts, particularly unsolicited links or attachments. Further details are pending as the investigation continues.

Quest Apartment Hotels Data Breach Exposes Nearly 2 Million Customers, Including Sensitive Financial and Identification Details A significant data breach at Quest Apartment Hotels has compromised the personal information of 1,991,613 customers, far exceeding initial estimates. The incident, first disclosed on 19 August 2024, was later revealed to include passport numbers, driver’s licence details, and credit card information some with CVV codes affecting hundreds of thousands of individuals. ### Scope of the Breach The breach exposed a range of sensitive data: - 104,268 customers had passport and/or driver’s licence numbers compromised. - 225,300 vehicle registration numbers were also accessed. - 46,727 credit card numbers, including CVVs, were stolen posing an immediate fraud risk. - An additional 297,739 credit cards (without CVVs) were exposed, some of which were expired. - 271 individuals had NDIS numbers leaked, while 46 had Medicare card details exposed. The breach originated from a third-party software vulnerability, exploited by an unknown threat actor on 17 August 2024, leading to a website outage. Quest’s forensic analysis confirmed that all exposed data predated June 2025. ### Potential Risks and Expert Concerns Cybersecurity experts warn that the combination of credit card details (with CVVs), names, and addresses enables immediate online fraud. While passport numbers alone cannot be used to obtain new documents, they can be leveraged in phishing scams when combined with other stolen data. Despite the severity, no data leaks have been found on the dark web, and no threat actor has claimed responsibility. The lack of a public extortion demand suggests the breach may have been used for payment fraud, identity theft, or intelligence gathering by state actors. ### Quest’s Response Quest has cooperated with Australian authorities, including the Office of the Australian Information Commissioner (OAIC), Australian Signals Directorate (ASD), Australian Cyber Security Centre (ACSC), and Victoria Police. The company has begun notifying affected customers and implementing cybersecurity improvements to prevent future incidents. Managing Director David Mansfield issued an apology, acknowledging the breach’s impact and thanking customers for their patience during the investigation. The Department of Foreign Affairs and Trade (DFAT) confirmed that affected passports remain valid for travel, though vigilance against scams is advised.