Quest Hotels data breach exposes nearly 2 million customers

Quest Apartment Hotels has confirmed a major data breach affecting the sensitive personal information of almost two million customers.

 

Headquartered in Victoria, Australia, Quest Apartment Hotels provides serviced accommodation for corporate and long-stay travellers. Part of The Ascott Limited, it operates over 170 properties, mainly across Australasia and Oceania, with a growing presence in Europe.

 

In a data security incident notice, Quest Hotel said that on 17 August, It identified unauthorised access to a database resulting from a vulnerability in a third-party service provider. The hotel authorities immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.

 

“Our investigation so far has confirmed that the information involved relates to records from before June 2025 and primarily involves names, email addresses, and/or other contact details. A small number of data entries also involve Date of Birth, Quest Hotel said.

 

The hospitality group later confirmed that passport and driver’s licence details were also affected. According to the Australian Passport Office, compromised passport numbers remain safe for international travel and cannot be used to obtain a new passport. Customers with affected driver’s licence details should contact their State or Territory roads authority for further advice.

 

Hotel authorities confirmed its investigation found that approximately 1,991,613 customers were affected by the data breach. The compromised information included 46,727 credit card numbers with CVVs, 225,300 vehicle registration numbers, 104,268 passport or driver’s licence numbers, 297,739 credit card numbers without CVVs, 3,328 dates of birth, 271 NDIS numbers, and 46 Medicare numbers. 

 

The hotel noted that some affected credit cards had expired and that only the numbers—not scanned documents or cards—were exposed.

 

Quest Hotel has notified the Office of the Australian Information Commissioner (OAIC), the Australian Signals Directorate (ASD), the Australian Cyber Security Centre (ACSC), and Victoria Police about the breach. These agencies are assisting with the investigation and assessing its impact on affected individuals.

 

“Quest Apartment Hotels has become aware of phishing activity including customers receiving unsolicited emails and WhatsApp messages impersonating Quest and asking them to confirm their upcoming booking by clicking on a link.

 

“If you receive an unsolicited message or email, do not click on the link and do not call the phone number in the message,” Quest Hotel added.