Quest Apartments data breach exposes sensitive customer information, prompting replacement warnings

Consensus Summary

Quest Apartments has confirmed a major data breach that exposed sensitive personal information for nearly 1.991613 million customers, with passport and driver’s licence numbers among the compromised data. The breach was first disclosed in August 2026, though forensic analysis later revealed additional categories of information, including credit card details with CVV numbers. Affected customers were advised to check their identification documents with authorities, though Quest later clarified that passports did not necessarily need replacement. The breach stems from unauthorised access to a database system through a third-party service provider, with initial reports suggesting only basic contact details were exposed before June 2025.

The breach’s scope expanded significantly after further investigation, with Quest identifying that 104,268 records contained passport or driver’s licence numbers. While no scanned copies of the documents were compromised, the exposure of CVV numbers and other financial details has led to widespread concern. Customers reported frustration over repeated data breaches, including those from Optus and Medibank, with some noting the inconvenience of reissuing licences and credit cards. The Australian Passport Office’s guidance played a key role in shaping Quest’s updated advice, though some customers initially dismissed the breach notifications as scams.

David Mansfield, managing director of The Ascott Limited Australasia, issued a public apology on behalf of Quest, acknowledging the distress caused by the breach. He emphasised that the initial disclosure had been limited to basic contact information, but forensic analysis later uncovered the full extent of the compromised data. Both 7NEWS and ABC highlighted Quest’s ongoing collaboration with authorities to inform affected customers, though the process has been described as time-consuming and inconvenient by those impacted. Mansfield’s statement underscored the company’s commitment to transparency, even as customers grappled with the practical fallout of the breach.

While both outlets agree on the core details of the breach, ABC provided additional context from affected customers, including specific examples of credit card fraud risks and the delays in reissuing identification. One customer noted that their data had been exposed six years ago, raising questions about the duration of the breach’s impact. 7NEWS, however, focused more on Quest’s official statements and the company’s response to the breach, without delving into individual customer experiences. The discrepancy in timelines—whether the breach began in August 2026 or extended back six years—remains unresolved, though Quest has not addressed the older claims directly.

The immediate next steps for affected customers include monitoring financial accounts for fraud and following up with relevant authorities to address exposed identification. Quest continues to work with third-party suppliers and regulatory bodies to mitigate further risks, though the long-term implications for customers remain uncertain. The breach has reignited discussions about data security in the hospitality sector, with calls for stricter protections against third-party vulnerabilities. As customers navigate the process of replacing compromised documents, the focus remains on whether Quest’s response will restore trust or exacerbate concerns about data privacy.