Ascott’s forensic update, reported by SBS on 18 September 2026, pushed the Quest Apartment Hotels breach from “large guest contact leak” to one of the most granular hotel disclosures Australia has seen this year: roughly 1,991,613 customers tied to records predating June 2025, including passport and driver-licence numbers for more than 104,000 people and credit card numbers—with CVV on tens of thousands of rows.
Quest confirmed the intrusion itself in August: a malicious actor exploited a vulnerability in a third-party service provider’s software, reached an unauthorized database on 17 August 2026, and was contained after remediation. The September census from managing director David Mansfield is company-attested via that reporting. If you stayed at Quest properties in Australia before mid-2025, assume you need to read the official notices—not a random SMS about “refunding your stay.”
What Quest and Ascott operate
Quest Apartment Hotels runs serviced apartments across Australia under the Ascott Limited umbrella (CapitaLand Investment). Guests book extended stays for business travel, medical appointments, and relocation—exactly the profile that produces passport scans, corporate cards, and vehicle registration details in property-management systems. The breach did not start inside Quest’s own developers’ laptops; it started at a third-party database operator whose software had a exploitable flaw.
That supply-chain shape matters for liability and for your response. Quest is contacting affected people by category, but the forensic counts describe what lived in the compromised database, not every downstream system Ascott operates today.
Timeline from discovery to September census
17 August 2026 — Unauthorized database access identified; attack attributed to exploitation of third-party provider software.
19 August 2026 — Public statements and media coverage (ABC, Quest statement via MediaNet) emphasized names, emails, and contact details, with a smaller date-of-birth set.
18 September 2026 — SBS publishes Mansfield’s expanded field inventory (~1.99M customers), breaking out payment and government identifiers that initial notices had not fully enumerated.
Quest’s dedicated update page at questapartments.com.au/update remains the canonical place for guest-facing instructions as categories of notification roll out.
Field-by-field exposure (company-attested)
The following figures come from Ascott MD David Mansfield as reported by SBS and match the BreachHistory catalog row. All relate to approximately 1,991,613 customers; records are pre-June 2025.
- Majority of rows: names and contact details
- 225,300 vehicle registration numbers
- 104,268 passport and/or driver licence numbers (numbers only, per the forensic update wording)
- 297,739 credit card numbers without CVV
- 46,727 credit card numbers with CVV (including expired cards)
- 3,328 dates of birth
- 271 NDIS numbers
- 46 Medicare card numbers
The presence of CVV data is especially painful: PCI programs treat CVV as sensitive authentication data that should not be stored post-authorization. Quest’s disclosure that CVV appeared on tens of thousands of records—even expired cards—signals either legacy logging, a payment gateway misconfiguration, or a backup that never got scrubbed. Guests should not infer “expired means safe”; fraud teams still abuse expired PAN+CVV pairs in weak merchant flows.
What we do not know publicly
Quest has not named the third-party provider in the indexed materials used for this article. The exact CVE or misconfiguration is unpublished. We also lack a per-property breakdown—whether every Australian Quest site fed the same database or a subset of brands. The Register framed the incident as PII leaking after a breach at the database operator, which aligns with the official root-cause line but does not replace a technical post-mortem.
Who is at risk—and how abuse might look
Leisure and business guests
Names, emails, and phones enable targeted phishing: “Your Quest invoice from 2024 is unpaid—pay here.” Corporate travelers may see BEC-style mail referencing real stay dates if those lived in the database.
Guests with payment cards on file
Nearly 300,000 card numbers without CVV still support card-not-present fraud where issuers skip strong customer authentication. The CVV subset raises the ceiling for successful CNP attempts. Rotate cards you used for Quest deposits, enable transaction alerts, and ask issuers for replacement if you receive a Quest notification letter.
Guests who supplied passport or licence numbers
Over 104,000 identity document numbers feed synthetic identity and account-opening fraud in Australia and abroad. Document numbers plus email are enough for convincing “hotel identity verification” scams.
NDIS and Medicare rows
The counts are small—271 NDIS and 46 Medicare numbers—but highly sensitive. Affected individuals should treat government-identifier exposure as priority for Services Australia and NDIS fraud lines, not just credit monitoring.
Vehicle registration data
225,300 vehicle registrations tied to guest profiles can power parking-fine scams, toll-road phishing, and physical stalking when combined with addresses from the same database.
Phishing examples specific to Quest
- “Quest Ascott security refund” with a PDF invoice from a Gmail address
- “Update your passport on file for upcoming stay” linking to a non-questapartments.com.au domain
- “Medicare verification required for corporate rate”—Quest corporate programs exist, but Medicare collection via email is a red flag
- “Download booking confirmation” malware attachments referencing real pre-2025 stay dates scraped from the leak
Official paths: the update URL above, phone numbers printed on past Quest correspondence, and the Ascott group channels cited in breach letters—not search-ad links.
Australian sector context
Hotel and serviced-apartment chains sit on years of guest PII and payment tokens. BreachHistory’s Australian lodging entries include Origin Energy’s ~900,000-customer incident, Qantas’s third-party CRM breach, and cloud misconfigurations exposing passport images. Quest’s third-party software angle rhymes with Qantas—operator brand, supplier software, delayed forensic clarity—though Quest’s September update is unusually specific on field counts.
Regulatory pressure under the Privacy Act and Notifiable Data Breaches scheme makes the staged August-then-September disclosure pattern familiar: early notice for contact data, deeper identity/payment buckets once forensic sorting finishes.
What Quest said
August statements (MediaNet) acknowledged unauthorized access, remediation, and customer outreach. September reporting through SBS carried Mansfield’s census. ABC’s 19 August coverage alerted the public while forensic work continued. The company is contacting affected individuals by category—if you get a letter, match it to the field list you recognize (card vs passport vs contact only).
Numbered action items
- Read Quest’s official update page and any postal or email notice for your exposure category.
- Replace payment cards used for Quest bookings before June 2025 if your letter mentions PAN or CVV.
- Place fraud alerts or credit bans with Equifax/Illion/Experian Australia if passport or licence numbers were included.
- Report NDIS/Medicare exposure through official government fraud channels if your notice cites those fields.
- Ignore refund or “rebook” links in unsolicited mail; call Quest using a number from a prior legitimate booking email.
- Monitor bank and loyalty accounts for CNP charges referencing hotel merchants.
- Retain booking confirmations to dispute social-engineering callers who guess stay dates correctly.
Was I affected?
Search terms like Quest Apartment Hotels data breach, 1.99 million customers, and Ascott forensic update lead here: if you stayed before June 2025, you are in the temporal scope of the database Quest described. Individual confirmation still requires a company letter or authenticated lookup—not a third-party “check your email” website.
Why August and September notices differed
Large breaches rarely ship complete field inventories on day one. Forensic teams must deduplicate rows, separate test bookings from guest PII, and decide whether expired payment tokens count as reportable payment card data. Quest’s August messaging emphasized contact details because that sorting finishes first. Mansfield’s September figures added vehicle registrations, travel documents, and card data buckets once analysts could count them reliably.
That two-step pattern confuses guests who read August headlines and assumed “only email.” If you stopped paying attention after the first wave, revisit Quest’s update page—your exposure category may have expanded on paper even though the underlying incident is the same August 17 access event.
Third-party software risk in hospitality PMS stacks
Property-management and booking middleware consolidate guest profiles across brands. A vulnerability in the provider’s software—exact product unnamed in indexed sources—gave an attacker database access without necessarily touching Quest’s corporate laptops. Ascott’s scale across Asia-Pacific means forensic teams must trace which Quest Australia properties fed the compromised database and whether migration to new platforms after June 2025 cut off fresh data from the same store.
The Register’s framing—that guests’ PII leaked after a breach at a third-party database operator—should push corporate travel managers to ask every serviced-apartment vendor about subprocessors, data retention, and CVV storage policies, not just encryption marketing slides.
PCI and identity-document fallout
Nearly 47,000 records with CVV attached is a regulator conversation even when cards are expired. Issuers may still reissue cards proactively for affected BIN ranges if Quest coordinates through payment networks—watch mail from your bank, not only Quest. Passport and licence numbers without images still satisfy many know-your-customer checks at fintechs; pairing them with emails from the same row is high-grade fraud fuel.
NDIS and Medicare counts are tiny but symbolically important: they show the database was not purely “business traveler email list.” Mixed sensitive categories in one DB is why notification-by-category matters; a contact-only letter should not be read as “no government IDs anywhere in the leak.”
Corporate and extended-stay guests
Serviced apartments host relocating families, medical patients near hospitals, and project teams on multi-month contracts—profiles that produce vehicle registrations on parking forms and passports on international bookings. HR and travel desks should warn assignees who used corporate cards for Quest deposits to align with finance on reissue and expense fraud monitoring.
Compare Booking.com’s 2026 guest reservation access incident: reservation data without payment cards still fueled phishing. Quest’s leak includes richer payment and ID fields when those categories apply to you—adjust urgency accordingly.
Australian notification law in plain terms
Under the Notifiable Data Breaches scheme, organizations must notify individuals and the OAIC when serious harm is likely from unauthorized access. Quest’s staged disclosure suggests serious harm assessments evolved as forensics matured. Affected people may receive different letter templates; all should be treated as authoritative over social-media “full dump” claims.
Extended action notes for families
If multiple household members stayed under one booking, primary booker contact data might appear alongside dependents’ document numbers entered for check-in. Children’s passport numbers in parental booking forms are a recurring hotel pattern—Quest has not published minor-specific counts, but family bookers should not assume only the adult email row leaked.
Vehicle registration exposure supports parking and toll scams near properties you actually visited; scammers who know your rego and a real stay date sound credible on the phone.
Canonical record and sources
BreachHistory catalog: 2026 Quest Apartment Hotels — third-party DB breach; ~1.99M customers.
- SBS — nearly two million customers affected
- Quest Apartment Hotels — official update
- ABC News — data security breach
- The Register — third-party database operator
Compare with Origin Energy’s 2026 customer breach for another large Australian consumer-data incident with company confirmation—different sector, similar notification pacing.
The Quest Apartment Hotels breach 2026 story is still unfolding on remediation and possible regulatory filings, but the September census is the anchor fact set: nearly two million customers, deep identity and payment fields, third-party software exploit on 17 August. Plan your response from that anchor, not from forum rumors.
Travel insurance and chargeback expectations
Travel insurance policies rarely cover data breach identity theft without a rider; identity monitoring offered by Quest, if any, will be described in official letters—not in this article, because indexed notices at catalog time emphasized forensic counts over benefit packages. Chargebacks for past stays cannot undo leaked passport numbers; focus on issuer reissue and document replacement workflows instead.
Ascott group customers outside Australia
This row documents Quest Apartment Hotels Australia guest records pre-June 2025. Other Ascott brands globally are not enumerated in Mansfield’s figures as reported by SBS. If you stayed at non-Australian Ascott properties, do not assume the 1.99M census includes you until a separate notice says so.
What to tell friends who share breach memes
Viral posts compress “2 million” into “everyone leak everything.” Share the field-level breakdown instead: many people are contact-only rows; a smaller subset carries cards and travel documents. Calibrated responses beat panic.
Document replacement for passport and licence numbers
Australian travellers who submitted passport numbers for long-stay check-in may need to contact their issuing authority about replacement if Quest’s letter confirms that category. Driver licence replacement varies by state; use official transport department sites, not “expedited licence” ads tied to breach keywords. Keep Quest’s notification letter as supporting documentation when agencies ask why you are replacing a document early.
Hotel breach 2026 context in APAC
Quest joins a crowded APAC lodging incident set on BreachHistory: Qantas CRM via supplier, Reqrea Tabiq passport images on misconfigured storage, Pokémon Center logistics partners. Third-party concentration is the recurring theme—guests choose a brand; data often lives at a processor. Ask Quest-specific questions through official channels, but let the Mansfield census drive your personal urgency tier.
Monitoring after card reissue
After replacing cards, watch for small verification charges at hotel merchants worldwide; fraudsters test stolen PANs quietly before luxury purchases. Enable push notifications on banking apps; report anomalies even if the merchant name looks like a generic travel charge.
Corporate accounts payable teams should flag any sudden change of bank details on Quest invoices received by email; BEC actors blend breach headlines with fake remittance instructions even when the underlying August incident did not expose AP systems directly.
Guests who used digital wallets for deposits should review wallet transaction history for the cards tokenized there, not only the physical plastic reissued by mail.