Nearly 2 million Quest Apartment Hotels customers have had their personal data compromised in a cyberattack involving a third-party technology provider, according to the accommodation provider.

David Mansfield, the managing director of parent company The Ascott Limited, said on Wednesday that a forensic analysis revealed information relating to 1,991,613 customers was affected in the incident, which involved records from before June 2025.

The compromised data includes credit card numbers, passport and driver licence details, Medicare numbers and vehicle registrations, according to AAP reports.