{
 "Event": {
  "uuid": "886dc369-da7a-5eb5-9539-82519eab05eb",
  "info": "Quest Aparthotel Chain Exposes Guest PII via Third-Party Breach",
  "date": "2026-08-17",
  "threat_level_id": "3",
  "analysis": "2",
  "distribution": "3",
  "published": false,
  "Orgc": {
   "name": "SecurityStudies.info"
  },
  "Tag": [
   {
    "name": "tlp:clear"
   },
   {
    "name": "securitystudies:status=\"curated\""
   },
   {
    "name": "securitystudies:type=\"data_breach\""
   },
   {
    "name": "misp-galaxy:country=\"australia\""
   },
   {
    "name": "misp-galaxy:country=\"new zealand\""
   },
   {
    "name": "misp-galaxy:country=\"fiji\""
   },
   {
    "name": "misp-galaxy:sector=\"hospitality\""
   }
  ],
  "Attribute": [
   {
    "type": "link",
    "category": "External analysis",
    "value": "https://securitystudies.info/cyber/incidents/quest-aparthotel-chain-exposes-guest-pii-via-third-party-breach/",
    "comment": "SecurityStudies.info entry",
    "to_ids": false
   },
   {
    "type": "link",
    "category": "External analysis",
    "value": "https://www.theregister.com/cyber-crime/2026/08/19/australian-hotel-chain-leaks-guests-pii-after-breach-at-third-party-database-operator/5289341",
    "comment": "source",
    "to_ids": false
   },
   {
    "type": "text",
    "category": "Other",
    "value": "Australian aparthotel chain Quest, which operates more than 120 properties across Australia, New Zealand and Fiji, disclosed unauthorised access to a database run by a third-party service provider, detected on 17 August 2026. Exposed guest records from before June 2025 included full names, email and contact details, and dates of birth in a small number of records.",
    "comment": "summary",
    "to_ids": false
   }
  ]
 }
}