For: anyone who has stayed at a Quest Apartment Hotels property (including business and leisure travellers visiting Australia from overseas), and anyone who handles card data for bookings or services. This article is based on Quest Apartment Hotels' official statements and public material from Australian agencies and the PCI Security Standards Council. It does not cover attack methods.
What guests should do today
Check for a notice, and check the sender's domain and number
Quest says it has emailed affected individuals directly and is using SMS or post for people without an email address on file. The notice tells you which of your information was affected. Check your spam folder.
Per Quest, genuine emails come from a domain ending in questapartments.com.au, and incident SMS messages come from +61 485 095 177 or +61 468 153 778. Look at the actual sender address, not just the display name.
If a card with its CVV was affected, ask your issuer about a replacement
Quest advises reviewing your statements and contacting your bank to report the breach. This site recommends one step further: for unexpired cards, ask about a replacement with a new number. A card number, expiry date and CVV together can be used for online purchases.
If your card was issued outside Australia, call the number on the back of the card. If only a number without CVV was affected, keep checking your statements.
Don't click 'confirm your booking' links in WhatsApp messages or emails
On September 25, Quest warned of emails and WhatsApp messages impersonating Quest and asking customers to confirm an upcoming booking by clicking a link. Don't click it, don't call the number in the message, and contact the hotel directly using the details on Quest's website. Quest says it will never ask for passwords or card details by SMS (see what is phishing?).
Passport numbers: don't rush to replace; check your issuer's advice
Citing the Australian Passport Office, Quest says that if your Australian passport number was compromised, your passport is still safe to use for international travel, and a passport number cannot be used to obtain a new passport. Only the number was affected, not an image of the passport.
That advice is about Australian passports. If you hold a passport from another country, follow the OAIC's general advice for exposed identity documents and contact the issuing agency.
Australian licence, Medicare or NDIS numbers: contact each agency
Quest's FAQ suggests contacting the following, so that a replacement number can be issued if needed:
- Driver licence: your state or territory roads authority
- Medicare number: Services Australia's Scams and Identity Theft Helpdesk (1800 941 126)
- NDIS number: the NDIS Fraud Reporting and Scams Helpline (1800 650 717)
If you have credit in Australia, consider a credit report ban
Quest's FAQ suggests considering a credit report ban, so credit reporting agencies can't disclose your credit file to credit providers without your written consent (it lists how to request one from Equifax and Experian).
The OAIC also recommends getting your credit reports when financial information is exposed. This step matters little for visitors who have no Australian credit file.
Need help? IDCARE, Scamwatch, cyber.gov.au
IDCARE is Australia's national identity and cyber support service; it assesses your situation and builds a tailored response plan (individuals: 1800 595 160). Scamwatch covers scams and reporting them; cyber.gov.au covers cyber incidents. Quest's FAQ also points to Scamwatch and cyber.gov.au.
① Card number + CVV (46,727)
→ Call your issuer, ask about a replacement, keep checking statements
② Card number only (297,739)
→ Tell your bank, check statements regularly
③ Passport / licence number (104,268)
→ Check the issuer's advice; doubt contacts that quote your number
④ Name and contact details only (most people)
→ Don't click links in "confirm your booking" messages
In every case: no scanned passports or ID documents were affected, per Quest
What happened (from Quest Apartment Hotels' statements)
Everything below is taken from Quest's official statements (August 19, August 21, September 16, September 23 and September 25) and its FAQ.
August 17, 2026
Quest identifies a website outage; its investigation confirms that a threat actor exploited a vulnerability in a third-party service provider's software and gained access to Quest's environment. The incident is contained.August 19
First statement: records from before June 2025, primarily names, email addresses and other contact details.August 21
Quest says for the overwhelming majority the information was limited to name and contact details, and that it has notified and is working with the OAIC, the Australian Signals Directorate (ASD), the Australian Cyber Security Centre (ACSC) and Victoria Police.September 16
Forensic data analysis completed: approximately 1,991,613 customers affected, with counts per category including card numbers with CVV.September 23
Guidance on passport and driver licence numbers; FAQ published.September 25
Warning about WhatsApp messages and emails impersonating Quest.
| Category (Quest's September 16 update) | Records |
|---|---|
| Vehicle registration number | 225,300 |
| Passport and/or driver licence number (number only, no scanned ID documents) | 104,268 |
| Credit card number (no CVV, including expired cards) | 297,739 |
| Credit card number with CVV (including expired cards) | 46,727 |
| Date of birth | 3,328 |
| NDIS number (number only) | 271 |
| Medicare card number (number only) | 46 |
- Scope
- Approximately 1,991,613 customers. Records from before June 2025
- Common to affected people
- Some combination of name, address, phone number and email address (the FAQ also mentions booking information and personal preferences)
- Some people
- As in the table above. Not every category applies to every individual
- Cause (Quest's account)
- A threat actor exploited a vulnerability in a third-party service provider's software and gained access to Quest's environment. Details of the vulnerability have not been disclosed
- Quest's response
- Contained the incident and completed remediation; investigated with external legal counsel and forensic data analysis specialists; strengthened security controls; required the third-party provider to remediate the affected environment and add security measures
- Authorities
- Notified and cooperating with the OAIC, ASD, ACSC and Victoria Police
How to read it: 'mostly names and contact details' grew
In August, Quest said the overwhelming majority of affected people had only name and contact details involved. About a month later, with the analysis complete, it published counts that include card numbers with CVVs and passport numbers.
It is still true that most people had only names and contact details affected, but if you read the first statement and decided it didn't concern you, check again for a notice. Quest says notifications are going out in stages as it verifies each person's information.
Why were CVVs in a hotel's records? What PCI DSS says
The 3- or 4-digit card verification code (CVV) printed on a card gets special treatment under the card industry security standard PCI DSS. According to public material from the PCI Security Standards Council (PCI SSC), which maintains the standard:
- Card verification codes are classed as sensitive authentication data (SAD), together with full magnetic-stripe (track) data and PINs.
- Sensitive authentication data must not be stored after authorization, even if encrypted, and this applies even in environments where no card number is present.
- Retaining card verification codes after authorization is not permitted even with the customer's permission, and even for card-on-file or recurring transactions. The exception is issuers and companies supporting issuing services with a legitimate business need.
- PCI DSS does not prohibit collecting the code before the transaction is authorized.
May be stored after authorization (protection requirements apply)
- Card number (PAN)
- Cardholder name
- Expiration date
- Service code
Not stored after authorization (sensitive authentication data)
- Card verification codes (CVV etc.)
- Full track data (magnetic stripe or chip equivalent)
- PINs and PIN blocks
So what were the 46,727 CVVs in Quest's records? Quest hasn't said. Whether they were captured at booking before authorization, how long they had been kept, and in which system and how they were stored have not been disclosed.
Quest's FAQ says the affected records were ones its third-party service provider had left on that environment, and that it is progressing its investigation with the provider. This site is not in a position to conclude from this information that anyone breached PCI DSS.
This site's view: as a guest, what you can do is limit where your CVV goes
The reason PCI SSC gives for banning post-authorization storage is that stolen codes can be correlated with other stolen data to reconstruct both the card number and the verification code. In other words, a CVV is information that should normally be gone once the payment is done, and the fact that it was sitting in booking records is what makes this incident more serious.
The realistic move for guests is to reduce the people and moments you hand a CVV to:
- Don't write card details into emails or chats with a property
- Where possible, choose options where payment completes on the spot
- Keep a single card for online use, so that when a notice like this arrives, the replacement is limited to one card
For another accommodation-booking incident this year, see the Booking.com reservation data access.
For businesses that handle card data
Quest's own account of the cause goes no further than "a vulnerability through a third-party service provider". What follows is general guidance for anyone taking card details for bookings or services. It is not a statement about the cause of this incident.
Find out where CVVs linger, in your systems and your providers'
Not keeping card verification codes after authorization is a principle PCI SSC's FAQs state repeatedly. Check not only your own database but providers' systems, old booking data and copies left over from migrations. As Quest's account shows, records can sit in a provider's environment.
Move to payment methods where you never hold card data
If card entry happens entirely on a payment provider's page, neither card numbers nor CVVs reach your side, so there is no card data on your side to leak. It also shrinks your PCI DSS scope.
Inventory what providers hold for you, and set deletion deadlines
Quest's affected records were from before June 2025. List what each provider holds for you and until when, and agree in both contract and operations that it is deleted when the deadline passes. The principles are covered in the minimum security baseline for organizations.
Sources (public record)
The facts in this article are based on the public information below. The service provider's name and undisclosed attack methods are not covered.
- Quest Apartment Hotels, "Statement from Quest Apartment Hotels" (August 19, 2026) — newshub.medianet.com.au
- Quest Apartment Hotels update page (official statements of August 21 and September 16, the September 23 passport and driver licence statement, the September 25 scam alert, and the FAQ) — questapartments.com.au/update
- PCI Security Standards Council FAQ 1280, "Can card verification codes/values be stored for card-on-file or recurring transactions?" — pcisecuritystandards.org
- PCI SSC FAQ 1533, "Why is storage of sensitive authentication data (SAD) after authorization not permitted even when there are no PANs in an environment?" — pcisecuritystandards.org
- PCI SSC glossary, "Sensitive Authentication Data" and "Cardholder Data" — SAD / CHD
- Office of the Australian Information Commissioner (OAIC), "Respond to a data breach notification" — oaic.gov.au
- IDCARE — idcare.org / Scamwatch — scamwatch.gov.au / ASD's Australian Cyber Security Centre — cyber.gov.au
Update history
2026-09-30: First version, based on Quest Apartment Hotels' statements and FAQ from August 19 to September 25, 2026, and public material from PCI SSC, the OAIC and others. Quest's investigation is continuing; we will update this if it publishes more.
Read next
- Another accommodation-booking incident: The Booking.com reservation data access
- The card standard: What is PCI DSS?
- ID numbers leaked elsewhere: Odido (Netherlands: passport and licence numbers) / AssuranceAmerica (US: driver's license numbers) / Times Car (Japan: licence images)
- Scams that follow a breach: What is phishing? / Devices on the road: Securing a laptop you carry around
- Other 2026 incidents: List of breaches and cyberattacks (Japan and worldwide)