:
Australia: Operator Quest Apartment Hotels has confirmed a security breach linked to a third-party service provider, with around 1.7 million records potentially involved.
Quest said the compromised data related to records from before June 2025 and included full names, email addresses and other contact details. A small number of records contained dates of birth.
According to 7NEWS, the breach affected around 1.7 million guests.
The company identified the unauthorised breach on 17 August 2026. “We immediately took steps to contain the incident and secure the affected systems,” the company said in a statement posted on its website.
“The incident arose from a vulnerability through our third-party service provider,” Quest told customers in an email. “We have contacted those we have identified as potentially affected to notify them and provide support, and we will continue to do so if our investigation identifies any further impact.”
According to Quest, remediation work is now complete.
The company has warned customers not to click on unexpected links or to open attachments, even if they came from the hotel.
Highlights:
- Australian accommodation operator Quest Apartment Hotels has confirmed a major security incident compromising a reported 1.7 million customer records.
- Arising from a technical vulnerability in a third-party service provider, the database intrusion exposed customer contact details predating June 2025.
- Identified on 17 August 2026, the unauthorised access exposed guest names and email addresses alongside dates of birth for a subset of records.
- Following the cybersecurity event, the serviced apartment operator confirmed system remediation work is complete and direct notification of affected guests has begun.
