Nearly 2 million Quest Apartment guests are being told to replace their passport, here’s what actually happened

Quest Apartment Hotels has told customers swept up in an August data breach to consider replacing their passport, and in some cases their driver’s licence, after the company confirmed the exposure was far larger than first disclosed. A forensic review now puts the number of affected customers at 1,991,613, with passport or licence numbers exposed for 104,268 of them and credit card numbers, some including the CVV security code, exposed for 344,466.

What was actually exposed

Quest says it identified unauthorised access to a database system on 17 August 2026, traced to a vulnerability in a third-party technology provider used across its apartment-hotel network. The company first disclosed the breach publicly on 19 August, but the full scope, the 1.99 million figure, and the fact that passport numbers and credit card CVVs were among the data taken, was only confirmed once the forensic investigation finished, weeks later. No scanned copies of passports or licences were exposed, only the numbers themselves, and the affected records all predate June 2025.

Is your passport still safe to use

Yes, for travel, but you may still want it reissued. The Australian Department of Foreign Affairs and Trade says a compromised passport number “cannot be used to obtain a new passport” and remains valid for international travel on its own. The real risk is identity fraud: a passport number combined with your name, date of birth and address is useful to someone building a false identity, which is why the Australian Passport Office is asking affected customers to contact it directly so it can decide whether to flag or reissue the document.

What you should actually do right now

Check whether Quest has emailed you directly, the company says it is contacting everyone whose passport, licence or card details were exposed. If your passport number was included, contact the Australian Passport Office, or the passport authority of your own country if you booked from outside Australia, and ask them to assess your record. If a card number was exposed, call your bank’s number on the back of the card, not a number from an email, and ask for a replacement rather than waiting for fraud to show up. Then watch your inbox: breaches this size reliably trigger a wave of phishing emails posing as the company itself, asking you to “verify your details” through a link. Quest will never ask for your full card number or passport number by email.

What this means if you are about to travel

It is also a reminder that any operator holding your passport number, a hotel chain, an airline, a trekking company arranging a Nepal permit, carries a version of this same risk. Ask how long they keep your documents, and choose ones who actually apply their security patches.

Cover photo: Evisa Express via Wikimedia Commons (CC BY 2.0). Section photos: Arturo A via Pexels (Pexels licence); cottonbro studio via Pexels (Pexels licence); Tima Miroshnichenko via Pexels (Pexels licence); https://kaboompics.com/ via Pexels (Pexels licence); Kenneth Surillo via Pexels (Pexels licence).