Loading story…
Quest Apartment Hotels disclosed a data breach after attackers gained unauthorized access to a database system through a vulnerability at an unnamed third-party service provider. The Australian aparthotel chain said it detected the intrusion on 17 August, contained the incident, and began notifying affected guests by email. Exposed records dated from before June 2025 and primarily included guests’ full names, email addresses, and other contact details, while a smaller subset also contained dates of birth.
Quest said it has fixed the affected systems, completed remediation, launched a forensic investigation, and engaged external cybersecurity and privacy advisers. The company also notified the Office of the Australian Information Commissioner and the Australian Cyber Security Centre, but did not disclose the number of affected customers or identify the vendor involved. Guests were warned to be alert for suspicious links or attachments that may appear to come from the hotel chain as the investigation continues.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
After discovering the incident, Quest said it immediately contained the breach, secured the affected systems, and completed remediation. The company also began forensic investigation work and engaged external cybersecurity and privacy advisers.
Quest Apartment Hotels said it identified unauthorized access to a database system on 17 August 2026. The company attributed the intrusion to a vulnerability at an unnamed third-party service provider.
Quest notified affected customers by email during the week of the reports, warning that records from before June 2025 were exposed. The compromised data included names, email addresses or other contact details, and a small number of records also contained dates of birth.
Quest said it notified the Office of the Australian Information Commissioner and the Australian Cyber Security Centre about the incident. The references do not specify the exact date of those notifications.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
BWH Hotels confirmed a cyberattack after detecting unauthorized access on April 22 that exposed customer reservation information stored in a web application. The compromised data included guests' names, email addresses, phone numbers, postal addresses, reservation numbers, stay dates, and special requests, with records generated between **October 14, 2025** and **April 22, 2026** potentially affected. The company said payment card and bank account information were **not** impacted. BWH Hotels said it took the affected application offline, revoked the unauthorized access, and brought in external cybersecurity experts to investigate and strengthen defenses. The company also warned customers to watch for phishing and other suspicious communications—including emails, texts, WhatsApp messages, or phone calls—that reference hotel reservations or stays and could use the stolen personal details to appear legitimate.
Jun 29, 2026
Booking.com warned customers that unauthorized parties accessed personal information linked to some reservations, exposing data that may include booking details, names, email addresses, physical addresses, phone numbers, and information shared with accommodations. The company said it detected suspicious activity, contained the incident, changed reservation PINs, and notified affected guests, while stating that payment or other financial information was not accessed from its systems. Booking.com did not disclose how many customers were affected. The breach was disclosed amid broader fraud and cybercrime pressure on the travel platform, including phishing and impersonation scams targeting Booking.com users. Reporting also highlighted rising consumer complaints and scam losses tied to travel-booking fraud, as well as scrutiny from an earlier Booking.com incident in which phishing against hotel staff exposed data from more than 4,000 people and later resulted in a **€475,000** regulatory fine after delayed breach reporting in the Netherlands.
Jun 29, 2026
Basic-Fit disclosed a breach affecting about **200,000 customers in the Netherlands** after unauthorized access allowed attackers to download personal data before the intrusion was stopped. The exposed information included membership details, names, addresses, email addresses, phone numbers, dates of birth, and **bank account details**. The company said it notified affected customers and reported the incident to the Dutch Data Protection Authority, while media reports indicated the wider impact may extend beyond the Dutch customer base and raised questions about controls that failed to prevent large-scale data exfiltration. Booking.com also warned customers that unauthorized third parties may have accessed reservation-related information after suspicious activity was detected on a number of bookings. The potentially exposed data included customer names, email addresses, phone numbers, and other booking details submitted during the reservation process. Booking.com said the full scope of the incident remains under investigation, reset PIN codes tied to affected reservations, and urged customers to watch for suspicious activity and phishing attempts leveraging the stolen information.
Jun 29, 2026