Quest Apartment Hotels (Ascott Australasia) identified the incident on 17 August 2026 after a website outage investigation showed a threat actor exploited a vulnerability in a third-party service provider and accessed Quest’s environment; Quest says the incident was contained and systems secured.

Managing Director update (16 September 2026 PDF / update page) states forensic analysis found information relating to approximately 1,991,613 customers, all from records before June 2025. Beyond name/address/phone/email contact fields, Quest publishes category counts: vehicle registration 225,300; passport and/or driver licence number only (no scanned ID images) 104,268; credit card number without CVV (incl. expired) 297,739; credit card number with CVV (incl. expired) 46,727; date of birth 3,328; NDIS number 271; Medicare card number 46.

Not every category applies to every person; Quest is notifying individuals in stages. Quest says it has notified and continues to cooperate with OAIC, ASD, ACSC and Victoria Police. Separate 23 September 2026 passport/licence clarification (company PDF): where an Australian passport number was affected, Quest cites Australian Passport Office advice that the passport remains safe to use for international travel (number alone cannot obtain a new passport; APO facial-recognition controls); where a driver licence number was affected, Quest says consider contacting the relevant state/territory roads authority.

Updated customer FAQ PDF dated 23 September 2026. ABC News (22 September 2026 UTC) reported customer SMS/email notices and earlier advice that prompted some guests to reissue licences/cards; treat ABC as secondary to Quest’s own PDFs.

Primary: Quest /update hub and linked 16 Sep + 23 Sep statements.

UPDATE (23 Oct 2026): Quest's update page links a 25 September 2026 scam alert saying customers have received unsolicited emails and WhatsApp messages impersonating Quest that ask them to confirm an upcoming booking by clicking a link; Quest says not to click the link or call the number in the message, and to contact the hotel directly using the details on the Quest website. The alert does not say whether these messages are connected to the data breach. (source: Quest (questapartments.com.au))