Australian hotel chain leaks guests’ PII after breach at third-party database operator
- ID
- 15478
- Status
- summarized
- Published
- 19 Aug 2026, 10:16 AM
- Fetched
- 19 Aug 2026, 2:21 PM
- Provider
- The Register
- Category
- technology
- Original URL
- https://www.theregister.com/cyber-crime/2026/08/19/australian-hotel-chain-leaks-guests-pii-after-breach-at-third-party-database-operator/5289341
- Source URL
- https://www.theregister.com/headlines.atom
Summary
- Score
- 3.0
- Created
- 19 Aug 2026, 2:23 PM
- Tags
- Audience
- saas_foundersdevelopers
What happened
Australian aparthotel chain Quest disclosed unauthorized access to a database system on 17 August 2026, caused by a vulnerability in an unnamed third-party service provider. Exposed data includes full names, email/contact details, and a small number of dates of birth from records prior to June 2025, across 120+ properties in Australia, New Zealand, and Fiji.
Why it matters
A concrete reminder that your third-party database or SaaS vendor's vulnerability becomes your breach and your customer notification obligation. If you operate in APAC hospitality or travel and use Quest-affiliated booking integrations, check whether your customer data flowed through their systems. For builders, the takeaway is to require breach notification SLAs in vendor contracts and inventory which third parties hold your customer PII.
Discussion angle
When a vendor won't even be named in the breach disclosure, how do you assess and communicate third-party risk to your own customers — and what contractual levers actually help when the incident isn't yours but the notification burden is?