Incidents
Wed 19 Aug
Updated Fri 23 Oct
Quest Apartment Hotels (Ascott Australasia) identified the incident on 17 August 2026 after a website outage investigation showed a threat actor exploited a vulnerability in a third-party service provider and accessed Quest’s environment; Quest says the incident was contained and systems secured. Managing Director update (16 September 2026 PDF / update page) states forensic analysis found information relating to approximately 1,991,613 customers, all from records before June 2025. Beyond name/address/phone/email contact fields, Quest publishes category counts: vehicle registration 225,300; passport and/or driver licence number only (no scanned ID images) 104,268; credit card number without CVV (incl. expired) 297,739; credit card number with CVV (incl. expired) 46,727; date of birth 3,328; NDIS number 271; Medicare card number 46. Not every category applies to every person; Quest is notifying individuals in stages. Quest says it has notified and continues to cooperate with OAIC, ASD, ACSC and Victoria Police. Separate 23 September 2026 passport/licence clarification (company PDF): where an Australian passport number was affected, Quest cites Australian Passport Office advice that the passport remains safe to use for international travel (number alone cannot obtain a new passport; APO facial-recognition controls); where a driver licence number was affected, Quest says consider contacting the relevant state/territory roads authority. Updated customer FAQ PDF dated 23 September 2026. ABC News (22 September 2026 UTC) reported customer SMS/email notices and earlier advice that prompted some guests to reissue licences/cards; treat ABC as secondary to Quest’s own PDFs. Primary: Quest /update hub and linked 16 Sep + 23 Sep statements. UPDATE (23 Oct 2026): Quest's update page links a 25 September 2026 scam alert saying customers have received unsolicited emails and WhatsApp messages impersonating Quest that ask them to confirm an upcoming booking by clicking a link; Quest says not to click the link or call the number in the message, and to contact the hotel directly using the details on the Quest website. The alert does not say whether these messages are connected to the data breach. (source: Quest (questapartments.com.au))
Quest — update hub + 16 Sep forensic MD statement + 23 Sep passport/licence PDF
breaches supply chain australia
Incidents
Tue 18 Aug
Updated Fri 23 Oct
Cyber Daily (18 August 2026) reports Victorian multi-clinic operator SIA Medical Centre is investigating unauthorised access after the Rhysida ransomware group listed it on 12 August. An SIA spokesperson said the organisation engaged cyber experts to contain the incident and assess personal information accessed; it has become aware an unknown third party named it online and published a small number of documents, is notifying those individuals, and has informed the Office of the Australian Information Commissioner and the Australian Cyber Security Centre. Distinct from other Rhysida cards on this desk (e.g. Berlin state-network). Correction (23 Oct 2026): removed Rhysida's own claims about record counts, data types, price and deadline; SIA has said only that a small number of documents were published. (source: https://www.cyberdaily.au/security/14058-exclusive-sia-medical-centre-confirms-it-is-investigating-cyber-incident-involving-patient-da)
Cyber Daily (18 Aug 2026)
australia identity
Brighton East Dental Clinic's official notice says ASD's ACSC alerted it on 13 August 2026 to a potential incident. On 17 August 2026 the clinic identified unauthorised access to data on on-premises file servers through its firewall, contained that access, and analysed leaked data. It assesses the access occurred in early April 2026 and involves records from before April 2026: patient contact details (name, address, date of birth, email, mobile), treatment plans, oral X-rays, referrals and treatment history, and private health insurance membership numbers. The clinic has not published a count of affected records. It says it notified OAIC, ACSC and Victoria Police, partnered with IDCARE, and that remediation is complete. This desk does not take actor names or leak sizes from secondary leak-site indexes.
Brighton East Dental Clinic notice
breaches australia
Incidents
Thu 13 Aug
Updated Fri 23 Oct
Nick Scali Limited's 13 August 2026 ASX release says it is investigating a security incident and elected to take certain systems offline. The company said it was bringing those systems back online, continuing to complete sales orders and deliveries, with slower-than-normal customer response times. At the time of the release, Nick Scali said it did not have any evidence of unauthorised access to customer data. It notified the Australian Cyber Security Centre and the Australian Federal Police, and said further updates would follow as appropriate. The Sydney Morning Herald (13 Aug) reported that chief executive Anthony Scali said the incident happened 'about mid-last week' and that staff were referring to manual records to get in touch with customers whose orders had been affected. UPDATE (22 Oct 2026): in an email to customers reported by the NZ Herald on 10 September, Nick Scali said details on sales orders, including name, email address, delivery address and phone number, were affected, and that no credit card details are recorded on sales orders because card payments go through a third-party provider. In its 21 October 2026 ASX trading update, Nick Scali said the incident left its ERP systems unavailable for about three weeks, with stores processing sales orders manually, and that about $980,000 of direct consultant and legal costs will be reported outside underlying net profit. Capital Brief, citing The Australian, reported that the attackers claimed to have customer details and demanded an unspecified ransom, and that Nick Scali hired an intermediary to negotiate; Nick Scali has not confirmed this in its ASX releases. CORRECTION (22 Oct 2026): this card earlier said customer-data access was not verified; Nick Scali has since told customers that sales-order details were affected (source: NZ Herald, 10 Sep 2026).
Nick Scali ASX trading update (21 Oct 2026)
australia retail
The University of Western Australia's own notice says that on 28 May 2026, UWA IT identified unauthorised external access to Callista, the university's Student Information Management System, after system access credentials were unintentionally exposed online. UWA says it secured the system and removed the vulnerability. Exposed fields, on that notice, include name, UWA student ID, UWA staff ID if applicable, home and mobile numbers, date of birth (day and month only), personal email, postcode, and enrolment status as at 2 April 2026, for some prospective students, current students and recent graduates. UWA says financial details were not involved, that it found no evidence of malicious use, and that it emailed affected people on 8 June 2026. UWA password resets were not required. ASD's ACSC had not published a matching alert at last check.
UWA Callista notice
breaches australia
Incidents
Thu 7 May
Updated Sat 24 Oct
Instructure detected unauthorised activity in Canvas on 29 April 2026 and a second access on 7 May 2026 that changed pages some students and teachers saw after login. The vendor says both used a Free-For-Teacher account path, took Canvas into maintenance, remediated the privilege-escalation routes, and permanently discontinued Free-For-Teacher. Fields named on the vendor FAQ include usernames, email addresses, course names, enrolment information, and messages; Instructure says core learning data (course content, submissions, credentials) was not compromised, and the US Education Department FSA alert (12 May, updated 29 May) repeats that there is no evidence passwords, dates of birth, government identifiers, or financial information were exposed. The US Education Department's FSA alert says a ransomware group identified as ShinyHunters claimed responsibility and repeatedly defaced Canvas login pages with ransom demands; Instructure later said it reached an agreement with the unauthorised actor, that data was returned with shred logs, and that customers should not engage the actor. Patch posture for customers: rotate Canvas integrations, LTI tools, SSO connectors, and API keys; review logs for 25 April–8 May 2026. Correction (24 Oct 2026): removed data-volume and institution counts that no linked source supports, and attributed the ShinyHunters claim to the US Education Department's FSA alert. (source: https://fsapartners.ed.gov/knowledge-center/library/electronic-announcements/2026-05-12/technology-security-alert-ongoing-cybersecurity-incident-involving-canvas-learning-management-system-updated-may-29-2026)
Instructure Security Incident Update & FAQs
australia cloud identity
