16 September 2026
A message from our Managing Director about your privacy and security
To our customers,
I am writing to provide a further update on the cyber security incident Quest Apartment Hotels identified on 17 August 2026.
As we previously advised, we identified unauthorised access to a database system arising from a vulnerability through a third-party technology provider. We immediately took steps to contain the incident and secure the affected system.
We have now completed a forensic data analysis into the incident. We have confirmed that information relating to approximately 1,991,613 customers was affected. All the information identified relates to records from before June 2025.
I recognise the concern this incident has caused. On behalf of Quest, I sincerely apologise to those who have been affected.
What our investigation has identified
In our earlier updates, we advised that for the overwhelming majority of impacted individuals, the information identified at that preliminary stage was limited to a combination of name and contact information.
Our forensic data analysis has now enabled us to determine the specific types of personal information affected.
We have now confirmed contact information for affected customers, included some combination of name, address, contact phone number and email address.
Other personal information identified varies between individuals as follows:
| Data Category | No. of Records |
|---|---|
| Vehicle Registration Number | 225,300 |
| Passport and/or Driver Licence Number (the number only, no scanned copies of ID documents were affected) | 104,268 |
| Credit Card Number (no CVV and including expired credit cards) | 297,739 |
| Credit Card Number with CVV (including expired credit cards) | 46,727 |
| Date of Birth | 3,328 |
| NDIS Number (the number only, no scanned copies of cards or documents were affected) | 271 |
| Medicare Card Number (the number only, no scanned copies of cards or documents were affected) | 46 |
Not every type of information listed above was affected for every individual.
We are contacting impacted individuals directly to advise them of the specific categories of personal information relating to them that was affected, as well as the practical steps they can take in response, and the support available.
Our response
Since identifying the incident, our priority has been to understand what occurred, contain the incident and provide accurate information and support to those affected.
We have worked with external legal counsel and forensic data analysis specialists throughout our investigation and have strengthened our security controls. We have also engaged with our third-party technology provider to remediate the affected environment and implement additional security measures.
We have notified and continue to cooperate with the Office of the Australian Information Commissioner, the Australian Signals Directorate, the Australian Cyber Security Centre and Victoria Police.
Advice and support
We encourage customers to remain vigilant for suspicious emails, text messages and telephone calls, particularly communications requesting personal, financial or account information.
If you receive a communication from Quest about this incident, please read it carefully. It will explain the specific information relating to you that was affected, the steps we recommend you take and the support available to you.
Notifications are being issued in stages as we verify the specific information relevant to each affected individual.
We encourage everyone to exercise caution in relation to unexpected communications claiming to be from Quest, a financial institution or government agency. Do not provide personal or financial information unless you are confident you know who you are dealing with, and independently verify suspicious communications through official channels.
Where available, we also recommend using multi-factor authentication and monitoring financial accounts and statements for unusual activity.
Further information, advice and support are available in our Frequently Asked Questions on our website.
Looking ahead
I want to thank our customers, business owners and partners for their patience and understanding while we completed this investigation.
We know that people trust Quest with their personal information when they choose to stay with us. We do not take that responsibility lightly.
We are sorry this incident occurred and for the concern it has caused. We remain focused on supporting affected individuals and on continuing our review of the measures used to protect information entrusted to us.
Sincerely,
David Mansfield
Managing Director, The Ascott Limited, Australasia
Please see Frequently Asked Questions here.
If you have any questions or concerns, please contact privacy@questapartments.com.au
Quest acknowledges the Traditional Owners and cultural Custodians of the land on which our apartment hotels are located throughout Australia and where we gather, work, travel and stay. We recognise and celebrate their continuing connection to lands, waterways and our local communities. We pay our respects to elders past and present for they hold the memories, cultures, traditions and hopes of all Aboriginal and Torres Strait Islander peoples.