← Quest Apartment Hotels

2026 Quest Apartment Hotels — third-party DB breach; guest names/emails/contacts (pre-Jun 2025); no census yet

2026 Unknown records affected Share on X

Data compromised

Per Quest (19 August 2026): records from before June 2025 — primarily names, email addresses, and other contact details; a small number of entries also include date of birth. No financial information per company. Trade press cites ~1.5M+ records potentially involved (Information Age) — not company-attested at indexing.

Technical writeup

Verified company notice — August 19, 2026. Quest Apartment Hotels (Ascott extended-stay network; 120+ properties in Australia, New Zealand, and Fiji) identified unauthorized access on 17 August 2026 to a database system through a vulnerability at an unnamed third-party service provider. Quest says it contained the incident, completed remediation, and undertook forensic analysis. Information involved relates to records from before June 2025: primarily names, email addresses, and other contact details, with a small number of entries including date of birth; no financial information per the company. Quest notified the Office of the Australian Information Commissioner and the Australian Cyber Security Centre and is emailing affected customers directly. Information Age (19 August) reported more than 1.5 million records potentially involved — a reporter estimate, not a company census; recordsAffected 0 pending OAIC or Quest attestation. Overseas guests who booked via Expedia/Wotif/Booking.com may be in scope if they stayed at Quest properties.

Root cause

Unauthorized access to a database via a vulnerability through a third-party service provider; identified 17 August 2026

References

Breaches you may like