Quest Apartment Hotels urges customers to replace passports and licences after expanded data breach

Quest Apartment Hotels disclosed that a security incident in August, caused by a vulnerability in a third-party service, exposed personal data of nearly two million guests. While the initial alert mentioned only names, email addresses and contact details, subsequent forensic analysis identified additional categories such as passport numbers, driver’s licence numbers, credit-card numbers and CVV codes. The firm has now instructed customers whose passport or licence information was compromised to seek replacements from the Australian Passport Office or their local road authority.

Customers like Steven Cooper, who has previously suffered breaches at Origin, Optus and Medibank, reported having to cancel cards and change passwords, noting the inconvenience and potential fraud risk. Another guest, Lizzy, learned that credit-card details from a six-year-old booking were also leaked, prompting renewed concern. David Mansfield, managing director for Australasia at The Ascott Limited, apologized and confirmed the breach affected 1,991,613 individuals. Authorities warn re-issuance can take up to two weeks for licences and six weeks for passports.