Nearly TWO MILLION Quest Apartment Hotels customers have been caught up in a major data breach — and some of the information exposed is extremely sensitive.
Quest has now completed its forensic analysis and confirmed that information relating to approximately 1,991,613 customers was affected.
The breach began when attackers exploited a vulnerability involving a third-party technology provider, gaining unauthorised access to a Quest database system. Quest detected the incident on 17 August 2026 and says it subsequently contained the breach and secured the affected system.
For most affected customers, the compromised information involved combinations of names, addresses, telephone numbers and email addresses.
But the forensic investigation uncovered much more:
225,300 vehicle registration numbers
104,268 passport and/or driver-licence numbers
297,739 credit-card numbers without CVVs
46,727 credit-card numbers with CVVs
3,328 dates of birth
271 NDIS numbers
46 Medicare card numbers.
Not every affected person had all of this information compromised, and some of the affected credit cards were already expired. Quest also says the affected information relates to records dating from before June 2025.
Quest is contacting affected customers directly to tell them which categories of their personal information were involved and what steps they can take. The company is also working with the Office of the Australian Information Commissioner, Australian Signals Directorate, Australian Cyber Security Centre and Victoria Police.
But once again, this raises a much bigger issue.
We hand over enormous amounts of personal information to businesses simply to participate in everyday life. How much of that information genuinely needs to be retained — and who bears the consequences when the systems holding it are breached?
That’s what we look at in this video.
🌐 Know Your Rights:
📕 Get the Know Your Rights book:
#DataBreach #QuestHotels #CyberSecurity #Privacy #IdentityTheft #Australia #KnowYourRights
source