Quest Aparthotel Chain Exposes Guest PII via Third-Party Breach

Data breach · Aug 17, 2026
Moderate STIX 2.1 MISP
Summary

Australian aparthotel chain Quest, which operates more than 120 properties across Australia, New Zealand and Fiji, disclosed unauthorised access to a database run by a third-party service provider, detected on 17 August 2026. Exposed guest records from before June 2025 included full names, email and contact details, and dates of birth in a small number of records.

Attribution
Not attributed
Where
AU Australia
Also: New Zealand, Fiji
Sectors: hospitality
EU relevance
Low
No EU member state, EU response or EU project sector involved
Graded by rules: EU member states affected, EU response, EU sanctions, EU projects in the sector hit.