Australian hotel chain leaks guests’ PII after breach at third-party database operator

Quest, an Australian aparthotel chain, has confirmed a data security incident that exposed personal information of its guests. The breach, which was identified on Monday, August 17, 2026, stemmed from a vulnerability in a third-party service provider's database system.

The company stated that the compromised data pertains to records created before June 2025. Information exposed includes guests' full names, email addresses, and other contact details. A limited number of entries also contained dates of birth. Quest operates over 120 properties across Australia, New Zealand, and Fiji, and the incident could affect both domestic and international visitors who booked stays through its own channels or third-party travel sites like Expedia, Wotif, and Booking.com.

Upon discovering the unauthorized access, Quest immediately took steps to contain the incident and has since implemented remediation measures. The company has initiated forensic investigations and engaged external cybersecurity and privacy advisors. All affected guests have reportedly been notified of the breach.

Quest has not publicly identified the third-party service provider responsible for the vulnerability, nor has it disclosed the specific method of the breach or the total number of customers impacted. The extent of the lost data, particularly how far back the records go, also remains undisclosed. The nature of the exposed data, including names, contact details, and dates of birth, could potentially be used for identity fraud attempts.