Peter A Clarke

Australian businesses are a long way behind their counterparts in the United States, the UK and the European Union in responding to data breaches.  Australian companies wait until the last possible moment to announce a data breach.  Often the announcement is made after the breach is publicised, by the hacker, the media or a customer.  When public statements are made they are commonly a series of boilerplate phrases cobbled together with very little information as to what happened and the potential exposure.  Statements like “working with the Australian Signals Directorate” and “notified in the Office of the Information Commissioner” and “contacted the Australian Federal Police”.  All designed the throw the proverbial blanket over the event.

But there are limited exceptions.  Quest suffered a data breach and was quite prompt in notifying customers by email.  It is reported by the ABC in Quest Apartment Hotels customers’ personal data exposed in security breach.  Quest couldn’t resist telling customers that it had contacted the Office of the Information Commissioner (as it is required to do by law so that is not an especially notable thing) and the Australian Cyber Security Centre.  It was shy about the scope of the attack, of which it probably has good knowledge.  Imperfect but a long way ahead of many Australian businesses.

The ABC article provides:

Quest Apartment Hotels says it is investigating a security breach that has affected customers’ personal data.

In an email to customers, seen by ABC News, Quest said the compromised data related to records from before June 2025 and included full names, email addresses and other contact details.

A small number of data entries also include customers’ date of birth.

“On Monday, 17 August 2026, we identified unauthorised access to a database system arising from a vulnerability through a third-party service provider,” a statement read.

“We immediately took steps to contain the incident and secure the affected systems. The incident has been contained.”

The company said it had notified the Office of the Australian Information Commissioner and the Australian Cyber Security Centre.

“We are very sorry this has happened and for any concern it may cause. Protecting the privacy and security of our customers is extremely important to us,” David Mansfield, managing director for Australasia at The Ascott Limited, said in the email to customers.

“We will contact you if our investigation identifies any further information that is relevant to you or if there are any additional steps you need to take.”

The company warned people not to click on unexpected links or to open attachments, even if they came from the hotel. 

Social media users across Facebook and Reddit confirmed they received emails from Quest overnight. 

The Ascott Limited owns Quest and other accommodation brands including Citadines and Oakwood, which operate in Australia and globally.

The ABC has contacted Quest and The Ascott Limited for more information, including about the scale of the breach.