Australian hotel chain leaks guests’ PII after breach at third-party database operator
Unknown parties know where you stayed last summer, down under, across 120 Quest properties
Australian aparthotel chain Quest disclosed a breach of customer data in an email to its clientele. The email, titled "Important Security Update Regarding Your Quest Data," notified recipients of unauthorized access to a database system and the subsequent containment measures. The breach originated from a vulnerability in Quest's third-party service provider.
The leaked information pertained to records from before June 2025 and encompassed guests' full name, email, and other contact details. Quest disclosed that a limited number of data entries also contained Date of Birth, increasing the risk of identity fraud for those affected. The company, however, refrained from revealing the third-party responsible for the breach, the method of the breach, or the exact number of customers impacted.
Quest, which has been in operation for over three decades, manages more than 120 properties, primarily in Australia, with additional locations in New Zealand and Fiji. The company has reached out to all affected guests, addressed the breach, and initiated forensic investigations and external cyber security and privacy adviser engagements.
This report is a developing story, and The Register will provide updates as additional information becomes available.
Written by urgent.news from The Register Science's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
