Quest Apartment Hotels Investigates Data Breach Linked to Third-Party Vendor
Customer records including names and contact details were exposed via a vulnerability in a service provider's system.
Quest Apartment Hotels is investigating a security breach that exposed customer personal information after unauthorized access to a database system was detected on Monday, August 17, 2026. The incident underscores the persistent risk that third-party vulnerabilities pose to large-scale corporate networks.
According to reports from ABC News and SmartCompany, the breach primarily affected customer records dating from before June 2025. The compromised data consists largely of names, email addresses, and contact details. SmartCompany further noted that a small number of the affected records also included customers' dates of birth. Quest has confirmed that the breach originated from a vulnerability within a third-party service provider rather than its own internal systems.
The Scale of Operations
Quest operates a vast network of over 160 locations across Australia, New Zealand, and Fiji. These hotels are managed by franchisees under an umbrella company owned by The Ascott Limited, a global hospitality network. Because of this structure, a single point of failure in a shared service provider can potentially impact a wide array of guests across multiple international jurisdictions.
Supply Chain Risks
This incident highlights the critical nature of supply chain security in the modern digital economy. When companies outsource data management or technical infrastructure to third-party vendors, they inherit the security posture of those partners. In this case, a flaw in a vendor's system became the gateway for unauthorized access to Quest's customer data, demonstrating that a company's security is only as strong as the weakest link in its vendor ecosystem.
Regulatory Response
In response to the discovery, Quest has notified the Office of the Australian Information Commissioner (OAIC) and the Australian Cyber Security Centre (ACSC). A spokesperson for Quest Apartment Hotels stated that "the security of our guests’ staff and partners’ information remains our absolute priority."
Investigators are continuing to determine the full extent of the unauthorized access. While the primary data leak involves older records, the company is working with authorities to mitigate further risk. Industry observers will be watching for further disclosures regarding which specific third-party provider was compromised and what steps are being taken to harden the supply chain against similar exploits in the future.