Quest Apartment Hotels — Third-party compromise

New incident
Third-party compromise
Verified from one official source

What this record states

Quest Apartment Hotels has reported a data breach through a platform operated by a third party.

The source states that information about customers was involved.

No source consulted for this record states when the incident occurred and when it was first publicly disclosed.

The number of people affected has not been stated.

Record overview

Incident date: Not confirmed
Discovery date: Not confirmed
Disclosure date: Not confirmed
Notification date: Not confirmed
Public record: 19 August 2026
People affected: Not stated
Who was affected: customers

Each date is either established by a quoted source or explicitly not confirmed. The public record date is when the incident was first publicly reported, not when it occurred.

Affected people and data

Categories of affected data

Not stated

Notifications and response

Regulators notified

Office of the Australian Information Commissioner

Law enforcement notified

Australian Cyber Security Centre

Legal and formal response

notified the Office of the Australian Information Commissioner

Technical and organisational remediation

Not stated

Official sources

Corroborating report

Quest Apartment Hotels hit by data breach

smartcompany.com.auRetrieved 19 August 2026

View official source

Further official sources

Corroborating report

Australian apartment hotel Quest reveals customer data breach after hackers accessed database | 7NEWS

7news.com.auRetrieved 19 August 2026

View official source

Corroborating report

Quest Apartment Hotels confirms data breach | Information Age | ACS

acs.org.auRetrieved 19 August 2026

View official source

Corroborating report

Faulty towers: Quest hotel chain discloses third-party customer data breach - Cyber Daily

cyberdaily.auRetrieved 20 August 2026

View official source

Corroborating report

Quest Apartment Hotels confirms customer data breach linked to third-party vulnerability - Australian Cyber Security Magazine

australiancybersecuritymagazine.com.auRetrieved 20 August 2026

View official source

Cleverer commentary

This section is commentary by Cleverer, not reporting, and is not drawn from the sources cited above.

Cleverer Insight

The verified record describes a third-party compromise affecting Quest Apartment Hotels customers. Quest attributed the incident to a vulnerability through a third-party service provider, but the supplier was not identified. The record says Quest contacted customers who may have been affected and would contact others if wider effects were established.

The incident and disclosure dates, affected number, data categories and technical or organisational remediation are not publicly established in this record. Quest reportedly notified the Office of the Australian Information Commissioner and the Australian Cyber Security Centre. The case illustrates how reliance on an external service provider can form part of the exposure pathway, while leaving important details about scope and impact unresolved.

How Cleverer may have helped

For this kind of failure, current evidence of third-party due diligence, contractual requirements, access arrangements, vulnerability management, monitoring, incident escalation and customer-notification decisions may help an organisation assess its position and explain the steps taken. Clear ownership, documented testing and oversight of suppliers could make it easier to establish what happened and identify potentially affected people.

Maintaining those records may assist governance, regulatory engagement and later review, but none of this would necessarily have prevented the incident, and it would not guarantee compliance or any particular security outcome.