Australian hotel chain leaks guests’ PII after breach at third-party database operator

Quest, an Australian aparthotel chain operating over 120 properties, disclosed that on 17 August 2026 an unauthorized party accessed a database via a third‑party service provider vulnerability, exposing guest PII (full names, email/contact details and some dates of birth for records before June 2025). The company says it has contained and remediated the systems, notified affected guests and engaged external cybersecurity and privacy advisers, but has not identified the third party or the number/range of impacted customers.