Quest Hotels — Exploited vulnerability

Update to a previously disclosed incident
Exploited vulnerability
Reported

What this record states

Quest Hotels has reported a data breach through an exploited software vulnerability.

The source states that information about customers was involved.

No source consulted for this record states when the incident occurred and when it was first publicly disclosed.

People affected: 1,991,613, estimated by the source.

Record overview

Incident date: Not confirmed
Discovery date: Not confirmed
Disclosure date: Not confirmed
Notification date: Not confirmed
Public record: 22 September 2026
People affected: 1,991,613, estimated by the source
Who was affected: customers

Each date is either established by a quoted source or explicitly not confirmed. The public record date is when the incident was first publicly reported, not when it occurred.

Affected people and data

Categories of affected data

Not stated

Notifications and response

Regulators notified

Office of the Australian Information Commissioner

Law enforcement notified

Australian Cyber Security Centre
Australian Signals Directorate
Victoria Police

Legal and formal response

Not stated

Technical and organisational remediation

Not stated

Official sources

Official notice

Quest Hotels data breach: Almost 2m impacted, almost 50k credit cards compromised - Cyber Daily

cyberdaily.auRetrieved 23 September 2026

View official source

Cleverer commentary

This section is commentary by Cleverer, not reporting, and is not drawn from the sources cited above.

Cleverer Insight

The record states that information relating to approximately 1,991,613 Quest Hotels customers was affected in a vulnerability-exploitation incident. The source describes the breach as occurring in August, but the incident, discovery, disclosure, notification and public-record dates are not otherwise publicly established in the verified record.

The data categories affected are not publicly established. The record confirms that the Office of the Australian Information Commissioner, the Australian Signals Directorate, the Australian Cyber Security Centre and Victoria Police were informed. It illustrates the scale and coordination challenges that can arise when a vulnerability affects a large customer population, while leaving the specific vulnerability, cause and remediation unrecorded.

How Cleverer may have helped

For this kind of failure, preparation may include vulnerability management, access controls, incident response arrangements, notification processes and clear records showing who assessed and approved relevant actions. Maintaining dated evidence of testing, monitoring, decisions, notifications and communications could make it easier to establish what occurred and how the organisation responded.

Governance and control oversight may help ensure that known risks are assigned, reviewed and escalated, with training and policies supporting consistent action. None of this would necessarily have prevented the incident, and the available record does not establish whether such measures were in place or effective.