Compuloop News · Cybersecurity · Updated 24 September 2026
The Quest data breach has put a difficult clean-up job in guests’ hands. Nearly two million customers’ information was affected, and some have been told their payment-card or identity-document numbers were involved. The frustration is justified. But the response should be based on which data was actually exposed—not a blanket instruction to replace every passport or licence.
The important correction: Following concern about earlier customer advice, Quest issued a 23 September clarification. The Australian Passport Office says an Australian passport remains safe for international travel if its number was exposed in this breach. Quest now advises people whose driver’s licence numbers were affected to consider contacting their state or territory roads authority about next steps.
What happened at Quest?
Quest says it identified the cyber incident on 17 August 2026, after an attacker exploited a vulnerability in a third-party technology provider’s software and accessed a database environment. In its 16 September investigation update, Quest said information relating to approximately 1,991,613 customers was affected. The information it identified related to records from before June 2025. Quest’s newer FAQ describes affected records as extending to July 2025; the public statements are not perfectly aligned on that cutoff.
Names and contact information were involved for affected customers. Quest also reported these categories of additional information. The figures below are records in each category, not a count of people who lost every item:
Quest also listed 225,300 vehicle registration numbers, 3,328 dates of birth, 271 NDIS numbers and 46 Medicare numbers. It says not every category applies to every customer and that notifications are being sent in stages.
What should an affected guest do now?
- Verify the notice safely. Read Quest’s official updates and FAQ by entering its website directly. Do not use a link in an unexpected text or email to submit personal or payment details. Quest says its notice should identify the categories of data relevant to you; its privacy team can be contacted through the details on its own site.
- If a payment card was affected, contact the bank or card issuer. Use the number on your card or in your banking app. Ask whether the card should be replaced and watch transactions. This matters particularly if your notice lists a card number with CVV. The Australian Cyber Security Centre recommends following your financial institution’s guidance rather than waiting for fraud to appear.
- If a licence number was affected, ask your roads authority. Replacement eligibility and the protective steps available depend on your state or territory. The ACSC says people whose licence details were compromised may be eligible for a replacement; the relevant authority can advise on your case.
- If an Australian passport number was affected, don’t assume the passport is invalid. The Australian Passport Office says it is still safe to use for international travel and that the number alone cannot be used to obtain a new passport. Read its Quest-specific advice before spending money or disrupting travel. For a non-Australian passport, consult the issuing authority.
- Watch for follow-on scams. An attacker may use a real name, booking context or leaked contact details to make a message look credible. Be wary of urgent requests for passwords, codes, card details or identity documents. For personalised identity support, the ACSC points Australians to IDCARE.
Why the clean-up burden is the real story
It is reasonable for customers to question why historical booking and payment information remained accessible in a third-party-connected environment. Quest’s FAQ says its service provider had left affected customer records there. That statement does not, by itself, establish a breach of data-retention law or prove which control failed. It does show why organisations need to know exactly what suppliers hold, how long they hold it and how it is removed.
The cost to a customer is not just a replacement card. It is time spent verifying messages, contacting banks or agencies, checking statements and staying alert for identity misuse. In ABC reporting on 23 September, affected guests described that inconvenience. Quest has apologised, said it contained the incident and says it is working with authorities. Customers still deserve clear, individualised notice and practical support.
What Australian businesses should take from this
The lesson is broader than hotels. If a vendor stores your customers’ data, its exposure is also your customer-trust problem. A useful review starts with five questions:
- Which suppliers and legacy systems still hold personal and payment information?
- What is the lawful business need and retention period for each data set?
- Can a supplier access, export or retain more information than it needs?
- Are payment details stored only where necessary, with appropriate controls and clear ownership?
- Could you identify affected people and their specific data categories quickly enough to give useful advice?
The ACSC’s customer-data guidance is a good starting point. Security reviews should cover supplier access, data minimisation, logging, tested incident response and customer communication—not just another password policy.
Know what your suppliers can access
Compuloop helps Australian businesses review their systems, third-party access and practical cyber controls. If you need a clear action plan for customer-data risk, let’s talk.
Sources checked 24 September 2026: Quest’s incident updates and 23 September FAQ; Australian Passport Office; Australian Cyber Security Centre; ABC News. This article is general information, not individual legal, identity or financial advice. Follow the advice of the relevant authority and your bank for your circumstances.
