Hotel chain Quest investigating customer data breach

Quest Apartment Hotels says it is investigating a security breach that has affected customers' personal data.

In an email to customers, seen by ABC News, Quest said the compromised data related to records from before June 2025 and included full names, email addresses and other contact details.

A small number of data entries also include customers' date of birth.

"On Monday, 17 August 2026, we identified unauthorised access to a database system arising from a vulnerability through a third-party service provider," a statement read.

"We immediately took steps to contain the incident and secure the affected systems. The incident has been contained."

The company said it had notified the Office of the Australian Information Commissioner and the Australian Cyber Security Centre.

"We are very sorry this has happened and for any concern it may cause. Protecting the privacy and security of our customers is extremely important to us," David Mansfield, managing director for Australasia at The Ascott Limited, said in the email to customers.

"We will contact you if our investigation identifies any further information that is relevant to you or if there are any additional steps you need to take."

The company warned people not to click on unexpected links or to open attachments, even if they came from the hotel. 

Social media users across Facebook and Reddit confirmed they received emails from Quest overnight. 

The Ascott Limited owns Quest and other accommodation brands including Citadines and Oakwood, which operate in Australia and globally.

The ABC has contacted Quest and The Ascott Limited for more information, including about the scale of the breach.