Loading story…
Quest Apartment Hotels disclosed that unauthorised access through a vulnerability at an unnamed third-party service provider exposed personal data belonging to approximately 1,991,613 customers. The affected database contained records dating from before June 2025 and included contact details, dates of birth, passport and driver's-licence numbers, vehicle registrations, Medicare and NDIS numbers, and payment data; 46,727 records included card numbers and CVV values.
Quest identified the incident on 17 August, notified Australian authorities, and advised affected customers to protect or replace compromised payment cards, consider replacing driver licences, and flag or reissue passports where appropriate. The company also warned of phishing emails and WhatsApp messages impersonating Quest. Australia's Department of Foreign Affairs and Trade said exposure of an Australian passport number does not allow an attacker to obtain a replacement passport, and affected passports remain valid for travel.
See attribution, scope, and your downstream exposure.
6 events from the most recent confirmed update back to the earliest known activity.
Quest Apartment Hotels identified unauthorized access to a database through a vulnerability at an unnamed third-party service provider and began an investigation with external cybersecurity experts. The affected records dated from before June 2025.
Australia's Department of Foreign Affairs and Trade said a compromised Australian passport number cannot be used to obtain a replacement passport. It stated that passports affected by the Quest breach remain safe for international travel and are protected by controls including facial recognition.
Quest advised customers with exposed driver's-licence information to consider obtaining a replacement licence and those with exposed passport numbers to contact the relevant passport authority about flagging or reissuing their passport. It also advised customers to take action regarding affected payment cards.
Quest warned that customers had received unsolicited phishing emails and WhatsApp messages impersonating the company and requesting booking confirmation through a link. It advised recipients not to click links or call phone numbers in those messages.
Quest notified the Office of the Australian Information Commissioner, the Australian Signals Directorate, the Australian Cyber Security Centre and Victoria Police. The agencies began assisting the investigation and assessing the impact on affected people.
A subsequent forensic analysis found that the breach affected information for 1,991,613 customers, including passport and driver's-licence details, payment-card data, vehicle registrations, dates of birth, NDIS numbers and Medicare numbers. Quest reported 46,727 card numbers with CVVs and 297,739 card numbers without CVVs among the exposed records.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Quest Apartment Hotels disclosed a data breach after attackers gained unauthorized access to a database system through a vulnerability at an unnamed third-party service provider. The Australian aparthotel chain said it detected the intrusion on 17 August, contained the incident, and began notifying affected guests by email. Exposed records dated from before June 2025 and primarily included guests’ full names, email addresses, and other contact details, while a smaller subset also contained dates of birth. Quest said it has fixed the affected systems, completed remediation, launched a forensic investigation, and engaged external cybersecurity and privacy advisers. The company also notified the Office of the Australian Information Commissioner and the Australian Cyber Security Centre, but did not disclose the number of affected customers or identify the vendor involved. Guests were warned to be alert for suspicious links or attachments that may appear to come from the hotel chain as the investigation continues.
Aug 19, 2026
Australia's privacy regulator found that the 2025 Qantas breach affecting about **5.67 million** customers began with a sophisticated tech-support **vishing** scam against a contact center agent. An attacker posing as Qantas IT support persuaded the employee to visit a malicious site and take actions inside the airline's CRM environment, linking the platform to a data-extraction tool and enabling the theft of customer records. The Office of the Australian Information Commissioner said Qantas had taken reasonable steps to protect personal information and declined to pursue a formal privacy investigation or find the airline in breach of the Australian Privacy Principles. The regulator cited prior audits of the contact center, recurring privacy and security awareness training, and role-based access controls, while noting the incident depended on an uncommon social-engineering technique and a default CRM setting. Exposed data included customer names, phone numbers, email addresses, and for some individuals addresses and dates of birth; **no financial data or passwords** were reported compromised.
Jul 22, 2026
Optus suffered a major breach that exposed personal information belonging to about 9.8 million current and former customers, including names, dates of birth, addresses, phone numbers, email addresses, and, for roughly 2.8 million people, passport or driver’s licence numbers. Australian officials publicly disputed Optus’s description of the intrusion as sophisticated, citing claims that an internet-exposed unauthenticated API and weak access controls enabled what the cybersecurity minister called a “basic hack,” while the company maintained a skilled criminal was responsible. The incident triggered investigations by the Australian Federal Police, the information commissioner, and ACMA, and intensified scrutiny of telecom-sector cyber oversight and penalties. A BreachForums user claiming responsibility demanded about **US$1 million** and threatened to publish stolen records in batches before later posting an apology and claiming the data had been deleted, a statement authorities did not verify. The fallout included identity-theft warnings, state support for replacing compromised licences, Optus-funded document replacement and credit monitoring, customer backlash over poor communications, and at least one criminal case involving alleged misuse of the stolen data to blackmail victims. The breach also led to a Deloitte review, court fights over disclosure of that report, customer losses, and a large class action as Australia moved to strengthen information-sharing and cyber laws.
Jun 29, 2026