Quest Apartment Hotels reports data breach exposing customers' personal information

Quest Apartment Hotels announced that on 17 August 2026 it detected unauthorized entry into a database through a flaw in a third-party service. The breach affected records created before June 2025 and exposed customers’ full names, email addresses and, for a limited number of entries, dates of birth. The firm immediately moved to isolate the affected systems and reported the incident to the Office of the Australian Information Commissioner and the Australian Cyber Security Centre.

In an email, David Mansfield, managing director for Australasia at The Ascott Limited, expressed regret and emphasized the importance of privacy, adding that the company would reach out if further relevant information emerges. Customers were cautioned against clicking unknown links or opening attachments, even if appearing to come from the hotel. Social media users on Facebook and Reddit confirmed receiving the notification emails.