Update

I am writing to provide a further update on the cyber security incident Quest Apartment Hotels identified on 17 August 2026.

As we previously advised, we identified unauthorised access to a database system arising from a vulnerability through a third-party technology provider. We immediately took steps to contain the incident and secure the affected system.

We have now completed a forensic data analysis into the incident. We have confirmed that information relating to approximately 1,991,613 customers was affected. All the information identified relates to records from before June 2025.

I recognise the concern this incident has caused. On behalf of Quest, I sincerely apologise to those who have been affected.

What our investigation has identified

In our earlier updates, we advised that for the overwhelming majority of impacted individuals, the information identified at that preliminary stage was limited to a combination of name and information.

Our forensic data analysis has now enabled us to determine the specific types of personal information affected.

We have now confirmed information for affected customers, included some combination of name, address, phone number and email address.

Other personal information identified varies between individuals as follows:

Not every type of information listed above was affected for every individual.

We are contacting impacted individuals directly to advise them of the specific categories of personal information relating to them that was affected, as well as the practical steps they can take in response, and the support available.

Since identifying the incident, our priority has been to understand what occurred, contain the incident and provide accurate information and support to those affected.

We have worked with external legal counsel and forensic data analysis specialists throughout our investigation and have strengthened our security controls. We have also engaged with our third-party technology provider to remediate the affected environment and implement additional security measures.

We have notified and continue to cooperate with the Office of the Australian Information Commissioner, the Australian Signals Directorate, the Australian Cyber Security Centre and Victoria Police.

We encourage customers to remain vigilant for suspicious emails, text messages and telephone calls, particularly communications requesting personal, financial or account information.

If you receive a communication from Quest this incident, please read it carefully. It will explain the specific information relating to you that was affected, the steps we recommend you take and the support available to you.

Notifications are being issued in stages as we verify the specific information relevant to each affected individual.

We encourage everyone to exercise caution in relation to unexpected communications claiming to be from Quest, a financial institution or government agency. Do not provide personal or financial information unless you are confident you know who you are dealing with, and independently verify suspicious communications through official channels.

Where available, we also recommend using multi-factor authentication and monitoring financial accounts and statements for unusual activity.

Further information, advice and support are available in our Frequently Asked Questions on our website.

I want to thank our customers, business owners and partners for their patience and understanding while we completed this investigation.

We know that people trust Quest with their personal information when they choose to stay with us. We do not take that responsibility lightly.

We are sorry this incident occurred and for the concern it has caused. We remain focused on supporting affected individuals and on continuing our review of the measures used to protect information entrusted to us.

Managing Director, The Ascott Limited, Australasia

Please see Frequently Asked Questions here.

If you have any questions or concerns, please [email protected]