Quest Apartment Hotels - 1.5 Million Guest Records, and the Attacker Who Never Touched Quest's Systems

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

Quest Apartment Hotels – 1.5 Million Guest Records, and the Attacker Who Never Touched Quest's Systems

A deep-dive into Australia's biggest hospitality breach of 2026 — and the vendor-ecosystem attack pattern behind it.

On Monday 17 August 2026, Quest Apartment Hotels — 160+ properties, founded in Melbourne in 1988, majority-owned since 2017 (and fully since 2022) by Singapore's The Ascott Limited — identified unauthorised access to a database system. The entry point wasn't Quest's own network: the company says access arose "from a vulnerability through a third-party service provider" holding Quest guest data. Two days later, on 19 August, Quest disclosed publicly and emailed affected guests under the signature of Ascott Australasia managing director David Mansfield.

What was taken: records predating June 2025 — full names, email addresses and contact details, street addresses in some records, and a small number of dates of birth. No financial or payment card data. Quest hasn't published a number; ACS Information Age reports more than 1.5 million records were potentially involved.

What we don't know: the vendor's identity, the specific vulnerability (no CVE published), and how the attacker got in — Quest has declined to answer. No threat actor has claimed responsibility and no ransom demand is public.

The response: containment and remediation completed before disclosure; OAIC, ACSC and other authorities notified; external cyber and privacy advisers engaged; all affected guests contacted.

In this episode:

• Why the vendor ecosystem is now the preferred way in — and how this breach follows Origin Energy, Partnered Health and Lifeline in a bruising winter for Australian data holders
• - The phishing second wave: why names + contact details + dates of birth are "the raw ingredients for convincing phishing and identity fraud" (Kash Sharma, BlueVoyant)
• - Five lessons for Australian businesses: map the vendors that touch your customer data; treat data retention as attack surface; know your Notifiable Data Breaches obligations; contract for security before the incident; and warn customers about branded scams that follow

Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: ABC News (19 Aug 2026); Information Age / ACS (19–20 Aug 2026); The Register (19 Aug 2026); Cyber Daily (20 Aug 2026); SmartCompany; Australian Cyber Security Magazine; Quest Apartment Hotels statement; 7NEWS.