Quest Apartment Hotels confirmed a major data breach affecting approximately 1,991,613 customers following an August 2026 incident where threat actors exploited a vulnerability in a third-party technology provider's software environment. Forensic investigation completed in mid-September 2026 confirmed the exfiltration of historical customer records (pre-June 2025) comprising names, physical addresses, phone numbers, and email addresses. The compromised dataset also included 225,300 vehicle registration numbers, 104,268 passport/driver licence numbers, 344,466 credit card numbers (297,739 without CVV and 46,727 with CVV), dates of birth, 271 NDIS numbers, and 46 Medicare card numbers. Quest contained the breach, notified law enforcement and relevant regulatory authorities (ACSC and OAIC), and initiated direct notifications to impacted customers.