Quest Apartment Hotels guests just found out their data was exposed in a breach

If you have stayed at a Quest apartment hotel before June 2025, your name, email and possibly your date of birth may now be sitting somewhere you never agreed to.

Quest Apartment Hotels confirmed on 17 August 2026 that a vulnerability in a third party service provider's system allowed someone unauthorised access to its guest database. More than 1.5 million records were potentially affected.

The exposed information is mostly names, email addresses and other contact details. A smaller number of records also included dates of birth. Quest says the data relates to bookings made before June 2025, meaning more recent guests are not caught up in this particular breach.

The company says it moved quickly once the vulnerability was identified, containing the incident and completing remediation work on the affected systems. Quest has notified the Office of the Australian Information Commissioner and the Australian Cyber Security Centre, as required when a breach is likely to cause serious harm.

Quest runs more than 160 serviced apartment locations across Australia, New Zealand, Fiji and the United Kingdom, which gives a sense of how many past guests could be sitting in that exposed database, corporate travellers and holidaymakers included.

Names and emails alone will not drain a bank account, but they are exactly the raw material behind convincing phishing emails and scam calls that reference real booking details to sound legitimate. Add a date of birth and you have given a scammer another piece of the identity puzzle needed to open accounts or reset passwords elsewhere.

Quest says its investigation is ongoing and it expects to share more information with affected customers as it comes to light. If you have stayed with Quest before June 2025, it is worth watching for their notification email and treating any unexpected calls or messages referencing your booking history with real suspicion.

This is not the first hospitality brand to get caught out by a third party vendor's weak link, and it will not be the last. If your loyalty programs are holding your date of birth, it might be time to ask why.