46,727 Credit Cards, 2 Million Identities: How the Quest Breach Fuels Payment Fraud

On 17 August 2026, Quest Apartment Hotels’ website went dark. By the time it came back online, a threat actor had quietly exfiltrated personal data belonging to 1,991,613 Australians. This week, Quest confirmed the full scope: 46,727 customers had their credit card number and CVV code stolen. Another 297,739 had card numbers exposed without CVVs. And 104,268 people face the inconvenience of replacing their passport or driver’s licence.

The coverage has mostly focused on what Quest guests need to do: cancel cards, call the Australian Passport Office, wait six weeks for a new passport. That response is right, but incomplete. The breach does not end when the forensic report is filed. The data keeps moving - and for every Australian finance team processing supplier payments over the coming months, that matters.

What the Breach Actually Exposed

Quest engaged external forensic specialists after detecting the intrusion on 17 August. The investigation, completed by mid-September, found the attack exploited a vulnerability in an unnamed third-party technology provider’s system. Quest’s own infrastructure was the target only in the sense that the data sat there - the entry point was elsewhere.

The scope, once fully enumerated, covers six data classes:

• 46,727 credit card numbers with CVV security codes (including expired cards)
• 297,739 credit card numbers without CVVs
• 104,268 passport and/or driver’s licence numbers
• 225,300 vehicle registration numbers
• 3,328 dates of birth
• 271 NDIS numbers and 46 Medicare card numbers

All records predate June 2025. Quest has notified the Office of the Australian Information Commissioner, the Australian Signals Directorate, the Australian Cyber Security Centre, and Victoria Police.

No threat actor has claimed the data publicly. Nothing has surfaced on known dark web forums as of publication. That absence is worth noting - it means the data may be in the hands of a professional operation that prefers to monetise quietly rather than a script kiddie looking for attention.

CVVs: Why This Data Class Matters

A CVV is the three- or four-digit code that proves the buyer physically has the card. Card-not-present transactions - every online purchase, every subscription renewal, every vendor invoice paid by card - require it. When a fraudster holds a card number, expiry date, and CVV together, they have everything needed to transact.

Incident response firm Cydarm Technologies was direct about the risk: records of this type “can immediately be used for online fraudulent purchases” when combined with the name and address data also included in the breach.

The window between breach and fraud is not weeks - it is hours. Markets for stolen card data operate continuously. A batch of 46,000 CVV-complete records is a significant inventory. Quest has noted the count includes expired cards, but the company has not disclosed what proportion remain active. Even at a 20% active rate, that leaves roughly 9,000 live cards.

Australian banks can and do block cards when notified of a compromise. The problem is notification lag. Quest completed its forensic investigation five weeks after the breach was detected. During that window, affected cardholders received no specific warning that their CVV had been exposed - only that “some contact details” might have been involved. Cards that were not proactively cancelled during that period remain vulnerable.

The Synthetic Identity Playbook

Card fraud is the immediate risk. The downstream risk is less visible and more expensive.

The combination of data in this breach - full name, home address, date of birth, passport number, driver’s licence number, and in many cases a credit card number - is enough to pass most business onboarding and KYC checks in Australia. Fraudsters who acquire this data do not use it only for online shopping. They use it to construct convincing personas that can do business.

This is the raw material for business email compromise and payment redirection fraud. A fraudster registers a vendor using a real person’s details - someone whose identity data came from a breach like Quest’s. The ABN search returns a real business. The identity documents are genuine. The vendor looks legitimate.

When that vendor later sends a payment instruction to an Australian business - an invoice with a bank account attached - the finance team has no obvious flag. The entity exists. The name checks out. The bank account is the only element the fraudster controls.

Australian businesses lost $166.8 million to payment redirection scams in 2025, per ACCC Scamwatch data. The ACCC’s 2025 annual scam report noted overall losses hit $2.18 billion - and payment redirection is a category that grows when verified identity data enters the market at scale.

A breach that puts 104,000 passport numbers and driver’s licences into criminal hands is a direct input to that figure.

Hospitality Is a High-Value Data Target

Quest’s breach is not the hospitality sector’s first. It is, however, the largest to hit an Australian accommodation provider.

Hotels and serviced apartments are attractive targets for several reasons. Their booking systems aggregate data across long time horizons - guest records going back years, with payment credentials attached to loyalty accounts or booking platforms. Third-party integrations are routine: property management systems, channel managers, review platforms, payment gateways. Each integration is a potential entry point.

The data profile of a hotel guest record is also unusually complete. A business traveller booking through a corporate account may have their employer’s ABN, their own name and contact details, travel dates, and a stored payment method in a single record. That combination supports targeted spear-phishing, invoice fraud, and corporate account takeover.

Australian businesses whose staff travel frequently should assume that some percentage of employees have records in the Quest database. The personal credentials of a CFO or accounts payable manager, obtained from a hospitality breach, are worth considerably more than the card details alone.

Your Third-Party Vendor Is Your Attack Surface

Quest did not fail to secure its own infrastructure in some obvious way. An unnamed vendor they relied on failed - and Quest’s customers paid the cost.

This pattern repeats. The majority of high-profile breaches in recent years have traced back to third-party software or service providers. In the Australian context, sectors that depend heavily on cloud-based property management, billing, and booking software - hospitality, healthcare, professional services, NDIS providers - accumulate personal and financial data in systems maintained by vendors who may not carry the same security investment as the organisations whose data they hold.

The question for every CFO and CISO reading this is not whether Quest’s vendor should have done better. It is: which of your vendors holds data that, if exfiltrated, would give a fraudster what they need to redirect your payments?

That is not a hypothetical. If your payroll platform holds bank account details. If your expense system stores card numbers. If your accounts payable software retains payment instruction history. Each of these is a third-party vector through which an attacker can source what they need.

Verify the Account, Not Just the Name

The fraud chain that starts with a data breach ends with a payment leaving your account. In between, there are several points where verification can interrupt it.

The weak link is not the identity check - it is the bank account check. Fraudsters building vendor personas using stolen credentials can pass ABN lookups, pass name-and-address verification, and submit documents that look real because they are real. What they cannot do is register the legitimate business’s actual bank account. They must substitute their own.

That substitution is the exploitable moment. A payment verification process that confirms the account number matches the entity - not just that the entity name looks right - catches this before money moves. Confirmation of Payee, which reached industry-wide coverage in Australia in 2026, addresses this for consumer-to-consumer and consumer-to-business transfers. Business-to-business payment flows still carry significant gaps.

For businesses processing supplier payments, particularly in sectors where payment instruction changes arrive by email, the account verification step is the control that matters most. It does not require the identity documents to be fake. It requires the bank account to match.

What Finance Teams Should Do Now

Quest is advising affected customers to cancel credit cards immediately and, if their passport number was involved, to contact the Australian Passport Office to discuss whether the document should be flagged or reissued. Licences take up to 14 days to replace; passports up to six weeks.

For finance teams, the actions are different.

Heighten scrutiny on payment instruction changes. In the months following a large breach, payment redirection attempts increase as stolen identity data circulates. Any supplier requesting a bank account update should be verified via a phone call to a number sourced independently - from a previous invoice, a website, or a direct relationship contact - not from the instruction itself.

Audit your own third-party vendor exposure. List the vendors that hold financial or identity data for your business and ask what their incident notification obligations are. A vendor breach that exposes your customers or staff does not have to hit the news for it to affect your payment risk profile.

Verify bank accounts at onboarding and on any change. This is the control that interrupts the fraud chain regardless of how convincing the supporting identity is. If the account does not match the entity, the payment should not proceed. That check should be automated and happen every time, not on a spot-check basis.

The Quest breach is a data breach story today. In three months, when some of those 104,000 government IDs appear in a vendor onboarding form, it becomes a payment fraud story. The window to act is now.

---

ezyshield is on a mission to eliminate payment fraud in Australia. We verify the person, the business, and the bank account before money moves - so payments only ever land with who they’re meant to. Learn more