Nearly 2 million Quest customers affected by data breach
Nearly two million Quest Apartment Hotels customers have had personal information affected in a data breach, with some records containing passport or driver licence numbers and credit card details.
Quest Apartment Hotels said information relating to 1,991,613 customers was affected. The information relates to records from before June 2025.The company said 104,268 records contained passport and/or driver licence numbers. No scanned copies of identity documents were affected.Credit card numbers were also involved. Quest said 297,739 records contained credit card numbers without CVV security codes, while 46,727 records contained credit card numbers with CVV details.Other information affected included names, addresses, telephone numbers, email addresses, vehicle registration numbers and dates of birth. Quest said not every type of information was affected for every customer.
The incident was identified on 17 August 2026, when Quest detected unauthorised access to a database system arising from a vulnerability involving a third-party technology provider. The company subsequently carried out a forensic investigation to determine the extent of the breach.David Mansfield, Managing Director of The Ascott Limited, Australasia, apologised to affected customers.
“I recognise the concern this incident has caused. On behalf of Quest, I sincerely apologise to those who have been affected,” he said.
Quest said it had contained the incident, completed remediation work and strengthened its security controls. It has also notified and is cooperating with relevant authorities, including the Office of the Australian Information Commissioner, the Australian Signals Directorate, the Australian Cyber Security Centre and Victoria Police.The company is contacting affected customers directly and advising them to be cautious about unexpected emails, text messages and phone calls requesting personal, financial or account information.
What affected customers should do
The Australian Passport Office said Australian passport holders whose passport numbers were affected can continue to use their passports for international travel. It said a passport number cannot be used by another person to obtain a new passport, although people should remain alert to possible identity fraud.People concerned about identity theft can contact IDCARE on 1800 595 160 for free advice and support. The Australian Passport Office lists IDCARE as a not-for-profit organisation specialising in advice and support for people affected by identity theft.
Quest has also advised affected customers to monitor their financial accounts and statements for unusual activity and use multi-factor authentication where available.
Source: Quest Apartment Hotels; Australian Passport Office.
