Quest Apartments customers across Australia are being urged to contact relevant authorities about their passports and driver's licences after a major data breach affecting nearly two million people was found to be significantly more serious than first disclosed.
What Was Compromised in the Quest Apartments Data Breach
The breach, which first came to light in August, has expanded in scope following a forensic investigation by the accommodation provider. A total of 1,991,613 customer records were affected, Quest has confirmed.
When the incident was initially disclosed, affected customers were told that personal information dating from before June 2025 had been accessed — primarily names, email addresses and other contact details. However, further forensic analysis has since revealed a far broader range of sensitive data was exposed.
The company has now confirmed that the compromised information also includes:
- Passport numbers
- Driver's licence numbers
- Credit card numbers, including CVV numbers
- Other personal information
Quest stressed that 104,268 records containing passport and/or driver's licence numbers were caught up in the breach, but emphasised that no scanned copies of identification documents were accessed.
Customers Advised to Contact Issuing Authorities
Affected customers received text messages informing them that forensic analysis had identified further categories of compromised information. Emails sent to those customers contained guidance on next steps regarding their identification documents.
The emails advised anyone whose driver's licence number was affected to consider contacting their local road authority about obtaining a replacement licence. Those with a compromised passport number were directed to reach out to the Australian Passport Office — or the relevant issuing authority in the case of non-Australian passports — to discuss whether their passport should be flagged or reissued.
When asked to clarify its position, Quest said its advice had always been for customers to check with the relevant issuing authorities as a precaution. The company also pointed customers to guidance from the Australian Passport Office, which indicates there is no need to replace a passport simply because its number was caught up in the breach.
Third-Party Supplier at Centre of Incident
Quest — operated by The Ascott Limited Australasia — said it is continuing to work with relevant authorities to keep affected customers informed. The company attributed the breach to a third-party supplier, though further details about that supplier have not been disclosed publicly.
Managing Director David Mansfield issued a personal apology to those caught up in the incident.
"For the overwhelming majority of impacted individuals, the information identified at that preliminary stage was limited to a combination of name and contact information," Mansfield said. "Our forensic data analysis has now enabled us to determine the specific types of personal information affected."
"I recognise the concern this incident has caused. On behalf of Quest, I sincerely apologise to those who have been affected."
What Affected Customers Should Do Now
Anyone who believes their information may have been compromised in the Quest Apartments data breach is encouraged to monitor their financial accounts closely and remain alert to any suspicious activity. Customers should also follow the specific guidance provided by Quest and cross-check any advice with official government authorities regarding their identification documents.
Data breaches affecting large numbers of Australians have become an increasingly pressing concern in recent years, with businesses of all sizes urged to strengthen their data security practices. For those wanting to understand more about how organisations handle sensitive customer data, data administration and security certification is one area gaining renewed attention.
Customers with concerns can also contact the Australian Cyber Security Centre or the Office of the Australian Information Commissioner for further guidance.
