Latest / Tech Talks With Kinsoft / Quest Apartment Hotels - 1.5 Million Guest Records, and the Attacker Who Never Touched Quest's Systems

Transcript

Quest Apartment Hotels - 1.5 Million Guest Records, and the Attacker Who Never Touched Quest's Systems · Tech Talks With Kinsoft

0:00
Welcome to this custom deep dive crafted entirely
0:03
for you. Today, our mission is to explore this
0:06
massive, honestly, incredibly revealing data
0:09
breach involving Quest apartment hotels. Oh,
0:12
yeah. A huge one. Right. Like they have been
0:14
an absolute staple of the Australian, New Zealand
0:18
and Fijian travel landscape since what? 1988.
0:21
Yeah. And we are looking at an incident where
0:24
over 1 .5 million guest records were just exposed.
0:27
We're pulling our insights today primarily. from
0:29
a phenomenal, really in -depth report by Tech
0:32
Talks with Kinsoft. So, OK, let's unpack this,
0:35
because the real paradox we are trying to solve
0:37
today is, well, this. How does a massive modern
0:40
company suffer a catastrophic data breach when
0:42
the attackers never even touch the company's
0:44
own IT systems? I mean, it really is the defining
0:47
security puzzle of our era right now. Yeah. And
0:50
that's exactly why this isn't just a story about
0:51
a single hotel chain, even one as massive as
0:54
Quest, which was fully acquired by the Ascot
0:56
Limited a few years back in 2022. Right. This
0:59
is a critical case study for you, for anyone
1:01
listening, really, because your data is currently
1:03
just floating across the modern vendor ecosystem.
1:06
Out there. Exactly. Every time you interact with
1:08
a business, your personal information doesn't
1:11
just sit in some isolated, impenetrable silo.
1:14
It gets passed along to this sprawling, often
1:18
completely invisible web of third party vendors.
1:22
So to really understand how this happens, I want
1:25
you to imagine that you have just built the ultimate
1:27
fortress. Like you have outfitted your house
1:30
with a state of the art security system. The
1:33
best money can buy. Exactly. You've got. Biometric
1:35
locks on the front door, laser trip wires in
1:38
the hallway, reinforced glass on every single
1:41
window. You have spent an absolute fortune making
1:44
sure absolutely nobody is getting through your
1:46
front door. Right, and you feel completely safe
1:48
because you control that perimeter. Your whole
1:50
IT budget went entirely into building those walls.
1:53
But then, you know, you have a contractor coming
1:55
over to fix the plumbing. You need them to do
1:57
their job, obviously, so you hand them a copy
1:59
of your key to get in. And what does the plumber
2:01
do? Weaves it in the truck. They leave that key
2:03
sitting right on the dashboard of their unlocked
2:04
truck while they go inside a cafe to grab lunch.
2:08
So the thief walking down the street, they don't
2:11
need to break down your reinforced door. They
2:13
don't need to hack your expensive alarm system
2:15
or bypass the biometrics. They just reach right
2:18
through the window. Right. They just reach through
2:20
the open truck window, pick up the key from the
2:22
dashboard, stroll up to your fortress and literally
2:25
just walk right in. And suddenly millions of
2:29
dollars in corporate security infrastructure
2:30
are rendered. completely useless by a single
2:34
vendor's oversight i mean the strongest front
2:37
door in the world simply does not matter if your
2:39
partner leaves the side door wide open yeah and
2:42
that brings us to the actual timeline of how
2:44
this uh this side door breach played out for
2:47
quest and the speed of it is honestly breathtaking
2:50
compared to how these incidents usually drag
2:53
on for months oh absolutely So on Monday, August
2:56
17th, unauthorized access is officially identified.
2:59
But to your point, the attacker didn't breach
3:01
Quest's servers. They compromised a third -party
3:04
service provider. An unnamed vendor, yeah. Yeah,
3:06
an unnamed vendor running a database that just
3:10
happened to hold Quest's desk data. The side
3:12
entrance. So once that vendor systems were compromised,
3:15
the threat actor essentially had a clear, unobstructed
3:18
hallway straight into those guest records. The
3:22
fortress walls were entirely... But here's the
3:25
pivot that really stands out. By Wednesday, August
3:28
19th. Which is incredibly fast. Literally just
3:31
48 hours later. Quest had apparently contained
3:34
the incident. published a detailed statement
3:37
on their website, and their managing director
3:40
for Australasia, David Mansfield, was already
3:42
sending direct emails to the affected guests.
3:45
That's right. Like people were waking up to these
3:46
notifications overnight. That is a massive operational
3:49
pivot in just two days. It is an incredibly rapid
3:52
response, and they deserve credit for that. But
3:55
to truly understand the gravity of what happened
3:58
between that Monday and Wednesday, we have to
4:00
look closely at the scale and the specifics of
4:02
the data that walked out the door. Okay, let's
4:04
get into it. So we are talking about historical
4:06
records dating from before June 2025. The data
4:11
fields include full names, email addresses, contact
4:14
details, and in some cases, physical street addresses
4:17
and dates of birth. Wow. Now, there is a massive
4:20
caveat that Quest was very quick to establish,
4:23
which is that no financial information or payment
4:25
card details were involved. OK, hold on. Let's
4:27
pause on the numbers for a second before we get
4:29
into the actual data itself. I actually read
4:31
a headline from a secondary news site claiming
4:34
one. 1 .7 million records were stolen. Ah yeah
4:37
I saw that too. So why the discrepancy? Are we
4:40
actually sure how much data is floating around
4:42
out there? Well the 1 .7 million figure was circulating
4:45
early on. The most thoroughly sourced figure
4:47
we have comes from the Australian Computer Society's
4:50
Information Age, which puts the count at around
4:53
1 .5 million guest records. Okay, 1 .5 million.
4:56
Right. And it's a vital distinction in the industry
4:59
to differentiate between raw database records
5:01
and unique individuals. Like one person might
5:04
have multiple overlapping records if they stayed
5:06
there a lot. But however you slice the data,
5:09
we are talking about well over a million people
5:12
whose personal details have been compromised.
5:14
I have to challenge the severity of this, though.
5:16
Like you mentioned Quest confirmed zero financial
5:19
data was involved. No credit cards, no banking
5:22
details, no payment histories. Right. Nothing
5:25
like that. So why is this considered such a massive
5:28
deal for the listener? I mean, if a hacker doesn't
5:30
have my credit card number, isn't this just a
5:32
digital nuisance? They get my name and my email.
5:35
Annoying, certainly, but. Is it actually a crisis?
5:38
Well, if we connect this to the bigger picture,
5:40
it is absolutely a crisis, just a completely
5:43
different kind of crisis than the one we have
5:45
been trained to fear. Kash Sharma, the Asia -Pacific
5:48
managing director at the security firm Blue Voyant,
5:51
breaks this down perfectly in the Kinsoft report.
5:54
He explains that names, contact details, and
5:57
dates of birth are not harmless trivia. They
6:00
are the raw ingredients for highly convincing
6:02
identity fraud and targeted phishing campaigns.
6:06
The raw ingredients. I love that analogy. It's
6:08
like a thief breaking into your house and raiding
6:10
the pantry. Exactly. They don't have the fully
6:12
baked cake yet, meaning they don't have direct
6:14
immediate access to drain your bank account.
6:17
But they have the flour, the sugar and the eggs
6:19
to bake one themselves. That is the exact mechanism
6:22
at play. Let's look at how we usually spot a
6:24
scam. You get a generic email. The formatting
6:27
is slightly off. There are spelling errors and
6:29
it addresses you as. Dear customer. Yeah, straight
6:33
to the trash. Right. Your brain instantly flags
6:35
it as suspicious and you hit delete. But now,
6:38
put yourself in the shoes of someone receiving
6:41
a phishing email powered by this specific database.
6:44
The email knows your full legal name. It knows
6:47
your date of birth. It has your home street address
6:49
sitting right in the footer. And it references
6:52
a specific time you stayed at a Quest property
6:54
before June 2025. That changes the psychology
6:58
entirely. If I get an email that says, urgent,
7:01
we noticed an overcharge on your recent stay
7:04
at this specific property. Please click here
7:06
to claim your refund. And it verifies my identity
7:09
using my actual home address. My guard is totally
7:12
down. Most people's would be. I would probably
7:15
click that link. Because the attacker has successfully
7:18
hijacked the context of trust, they are no longer
7:21
just blasting out generic spam hoping someone
7:23
clicks. They are crafting a hyper -specific narrative
7:26
that aligns perfectly with your lived reality.
7:30
Right. They can send fake Quest -branded booking
7:32
confirmations, loyalty program verifications,
7:35
or even urgent security alerts asking you to
7:38
reset your password, which, of course, just hand
7:41
your password directly to them. That is terrifying.
7:43
And we have to consider how broad this net really
7:45
is, because you're saying I could have booked
7:47
a room through an aggregator like Expedia, Wotif,
7:50
or Booking .com. I might never have once visited
7:53
Quest's actual website or spoken to their front
7:56
desk, but because they service the room, my data
7:59
ends up in this vendor's database, and now it's
8:02
just in the wind. Exactly. The supply chain of
8:05
data means you don't even need a direct relationship
8:07
with the company to be caught in their breach.
8:10
And this introduces the concept of the second
8:12
wave. The second wave. Yeah, the true devastating
8:16
harm of a breach like this almost never happens
8:19
on day one. On day one, the data is simply extracted
8:22
and sorted. The real damage arrives weeks, sometimes
8:25
months later, as a secondary wave of branded
8:27
phishing. Wait, why the delay? Why not attack
8:30
immediately while the data is fresh and they
8:32
just stole it? Because attackers are strategic.
8:34
If they launch fake Quest emails on August 20th,
8:37
right when Quest is warning everyone about a
8:39
breach, the victims are on high alert. I thought
8:41
that makes sense. The attackers wait until the
8:43
news cycle fades, until people have completely
8:45
forgotten about the warning email they got from
8:47
David Mansfield. When that second wave hits in
8:49
late September or October, the urgency of the
8:52
initial breach is gone, and the phishing trap
8:54
is infinitely more effective. Here's where it
8:56
gets really interesting to me. We know how the
8:59
data is weaponized. We understand the mechanics
9:02
of the phishing. But we have absolutely no idea
9:05
who is doing the weaponizing. The criminal side
9:08
of this story is a completely blank page. The
9:11
silence surrounding this specific incident is
9:14
perhaps the most unsettling part of the entire
9:16
Kinsoft report. It is entirely a ghost town.
9:19
The third party provider. Unnamed by Quest. The
9:23
specific vulnerability they use to get into this
9:25
system. There is no published CVE. And that's
9:28
rare. Right. For anyone unfamiliar with the term,
9:31
CVE stands for Common Vulnerabilities and Exposures.
9:34
It is basically the cybersecurity industry's
9:36
official public catalog of known software flaws.
9:39
When a piece of software is broken, it gets a
9:42
CVE number so everyone knows to patch it. But
9:44
there's nothing here. There is no CVE here. No
9:47
threat actor has jumped onto a dark web forum
9:49
to claim responsibility for the hack and there
9:51
have been no public ransom demands. Major news
9:54
outlets like the ABC and the Register have repeatedly
9:56
asked questions and they are just getting crickets.
9:59
We need to look at why that absence of a CVE
10:02
is so crucial. When there is no known software
10:05
flaw being exploited, it usually means the attackers
10:08
didn't need to write complex code to break down
10:10
a digital wall. The plumber's key. Exactly. It
10:13
heavily implies they just walked in through an
10:15
open door. They likely used social engineering
10:18
against an employee at that third -party vendor.
10:20
Or, you know, they bought stolen administrative
10:22
credentials on the dark web. They logged in as
10:25
an authorized user. Wow. That is why Quest Fortress
10:28
didn't trigger any alarms. The system saw someone
10:32
using the plumber's key and assumed everything
10:34
was totally fine. And that silent, stealthy approach
10:37
perfectly reflects the shifting tactics in the
10:39
broader cyber landscape. The report notes this
10:42
Quest incident did not happen in a vacuum. It
10:45
is part of what Kash Sharma calls a bruising
10:47
winter for Australian data holders. The pattern
10:50
is undeniable. Over just a few months, we saw
10:52
the Origin Energy breach affecting around 900
10:55
,000 customers. We saw the Pardoned Health breach.
10:58
We saw the Lifeline staff data breach. A bruising
11:01
winter indeed. It feels relentless. But how do
11:04
those incidents connect to Quest? Are they all
11:07
using the same broken software? Not necessarily
11:11
the same software, no, but they're all victims
11:13
of the exact same architectural flaw. What Sharma
11:17
identified is that attackers are actively abandoning
11:20
the heavily fortified front doors of massive
11:23
corporations. Right, because it's too hard. Yeah,
11:25
they know companies like Quest, Origin, Energy,
11:28
and Lifeline have enormous multi -million dollar
11:30
security budgets. Yeah. It is too hard and too
11:33
expensive to hack them directly. So instead,
11:35
the attackers map out the target's vendor ecosystem.
11:37
They look for the weak link. They hunt for a
11:40
smaller, less resourced third -party provider,
11:42
maybe a marketing analytics firm, a booking engine,
11:45
or a specialized HR software that just happens
11:47
to hold the data for these giants. They strike
11:50
the soft underbelly. Precisely. They strike where
11:52
security budgets are lower and visibility is
11:55
at its absolute weakest. Which means, for you
11:57
listening, the entire concept of a security perimeter
12:00
has completely fundamentally changed. It is no
12:03
longer a wall around an AUKUS building. It is
12:05
a sprawling, invisible web of contracts. Yep.
12:08
And recognizing that this vendor ecosystem is
12:11
the new battlefield, we need to transition into
12:14
how businesses and individuals actually survive
12:16
this reality. The Kinsoft report explores several
12:20
core themes. And honestly, even if you aren't
12:23
running a multinational hotel chain, understanding
12:26
this dynamic changes how you should view your
12:28
own digital footprint. The first glaring reality
12:31
we have to confront is that in the eyes of the
12:34
public, the vendor's breach is your breach. It
12:37
feels incredibly unfair from a business perspective.
12:39
I mean. Quest's internal IT team didn't fail.
12:42
Their servers weren't compromised. No, they weren't.
12:45
But Quest's logo is the one plastered across
12:47
all the headlines. They are the ones wearing
12:50
the reputational damage and the loss of consumer
12:52
trust. And they are the ones facing regulatory
12:54
scrutiny from the Office of the Australian Information
12:57
Commissioner, the OAIC. Because accountability
12:59
cannot be outsourced. You can hire a vendor to
13:01
manage your databases. You can outsource your
13:03
server hosting to the cloud. But the trust your
13:06
customer placed in you when they handed over
13:07
their personal details. That remains entirely
13:10
your responsibility. So if a company is ultimately
13:13
holding the bag for their vendors, it completely
13:16
reframes the conversation around data hoarding.
13:19
Like we mentioned earlier that the stolen data
13:21
was entirely from before June 2025. It was historical
13:25
data just sitting there. Just waiting. But wait,
13:28
we've been told for a decade that data is the
13:31
new oil, right? Companies are instructed to collect
13:34
everything, keep everything forever, use it for
13:37
AI training, use it for targeted marketing. Are
13:40
you saying the fundamental business model of
13:42
the last decade is now a massive security flaw?
13:45
What's fascinating here is the tension between
13:47
marketing and security. Marketing departments
13:50
want to keep a 10 -year -old booking record because
13:52
they might want to send that customer a promotional
13:54
email someday. Right. But security teams look
13:57
at that 10 -year -old record and see nothing
13:59
but liability. Storage might be incredibly cheap,
14:02
but the cost of losing that data is astronomical.
14:05
As the source material bluntly states, personal
14:08
information cannot be reset like a password.
14:10
Right. Like if a hacker steals my Netflix password,
14:13
Netflix forces a system -wide reset, I type in
14:16
a new one, and the crisis is over. five minutes.
14:19
But if they steal my date of birth and my home
14:21
address, I can't exactly call up the government
14:23
and say, hey, I need a new birthday. Mine got
14:25
leaked in a vendor breach. No, you can't. And
14:28
that permanence is why data retention is an attack
14:30
surface. The longer you hold on to data you don't
14:34
actively need, the wider your attack surface
14:36
becomes. The golden rule for modern organizations
14:39
has to be. If you do not actively need that specific
14:43
piece of data to serve the customer today, delete
14:46
it. Delete it. Every gigabyte of unnecessary
14:48
historical data sitting in a vendor's bucket
14:51
is a loaded weapon pointing directly back at
14:53
your brand. So if a marketing department refuses
14:56
to let go over that old data and a vendor eventually
14:59
gets compromised, who actually steps in to hold
15:01
them accountable? That brings us to the regulatory
15:04
reality, the Notifiable Data Breaches Scheme,
15:07
or NDB. Right. The NDB scheme is the legal framework
15:11
governing this exact scenario in Australia. If
15:14
you are a business with over $3 million in annual
15:16
turnover, or even a smaller business operating
15:19
in specific sensitive sectors like health providers,
15:22
this law applies to you. You have a strict legal
15:25
obligation to assess suspected breaches and formally
15:28
notify both the OAIC and the affected individuals.
15:32
Just to give you context on the sheer scale of
15:34
how often this is happening, the OAIC received
15:36
over 1 ,200 breach notifications last year alone.
15:40
Let that sink in. That is more than three times
15:43
a day, every single day of the year, that an
15:46
Australian company had to put their hand up,
15:48
contact the government and say, we lost our customers'
15:51
data. It is a staggering volume. But this is
15:54
exactly where the Kinsoft report praises Quest.
15:57
When you are one of those 1 ,200 companies having
16:00
a very bad week, the playbook matters. Quest
16:03
detected the issue on Monday and disclosed it
16:05
by Wednesday. Which we said is huge. And crucially,
16:08
they did not bury the notification in dense legal
16:10
jargon designed to protect the company's liability.
16:12
They sent direct plain English warnings to their
16:15
guest. They explicitly included scam warnings
16:18
so customers knew what to look out for. It's
16:20
the gold standard for incident response. But
16:23
ideally, you want to solve the problem before
16:26
you ever have to draft that plain English apology.
16:28
which means we need to talk about how companies
16:31
actually manage these vendors. This raises an
16:34
important question. When is the right time to
16:36
secure your vendor contracts? I'm going to guess
16:39
it is definitely not after a journalist calls
16:41
you asking about a data leak. Definitely not.
16:45
The time to establish your defenses is during
16:47
the procurement phase, before the contract is
16:49
ever signed. Quest noted in their statement that
16:52
they are working closely with their provider
16:54
on remediation. But the source material emphasizes
16:58
that you cannot rely on trust. Nope. You must
17:01
bake security directly into the legal agreement.
17:03
You need to establish audit rights, mandate strict
17:06
breach notification deadlines, and legally require
17:09
minimum security controls. What does an audit
17:12
right actually look like in practice, though?
17:13
It means you have the contractual authority to
17:16
demand proof that the vendor is doing what they
17:18
promised. You can demand to see their SOC 2 compliance
17:21
reports, which are independent audits of their
17:23
security practices. You can require them to undergo
17:26
regular penetration testing, where ethical hackers
17:29
try to break into their systems to find flaws
17:31
before the bad guys do. If you wait until a breach
17:35
happens to ask how a vendor secures your data,
17:37
the data is already gone. And once the data is
17:40
gone, we arrive at the final and I think most
17:42
proactive strategy for dealing with the public.
17:45
We talked about the devastating second wave of
17:48
branded phishing. How does a company actually
17:50
stop that from working? You have to fundamentally
17:53
change how you communicate with your customers.
17:55
You have to tell them exactly what you will and
17:57
won't ask for in the future. Immunizing the customer
18:00
base. So if Quest sends an email stating, we
18:03
will never email you asking you to confirm your
18:05
password, and we will never send you a direct
18:07
link to input credit card details for a past
18:09
stay, they instantly blunt the weapon the attackers
18:12
just stole. Exactly. When the customer receives
18:14
that highly convincing, hyper -targeted fake
18:16
email a month later, it contradicts the rules
18:19
Quest established. The customer remembers the
18:22
warning, they pause, and they don't click the
18:24
link. It empowers the individual, shifting them
18:27
from being a passive victim of a data breach
18:29
to an active participant in their own digital
18:31
defense. So, what does this all mean for you?
18:35
When we step back and look at this entire timeline,
18:38
the rapid Monday to Wednesday response, the theft
18:41
of the raw ingredients for identity fraud, the
18:44
completely silent threat actors bypassing the
18:46
fortress, and the absolute critical necessity
18:49
of wrangling your vendor contracts, the core
18:52
takeaway for anyone operating in 2026 is crystal
18:55
clear. Yep. Your company's security perimeter
18:57
is only exactly as strong as the least secure
18:59
vendor holding your data. It absolutely does
19:02
not matter how thick your vault door is if the
19:04
guy you hired to polish the vault has a habit
19:06
of leaving the combination on a sticky note.
19:08
on his desk. That is the inescapable architectural
19:11
reality of the modern vendor ecosystem. And for
19:15
you, the listener, whether you are managing risk
19:17
for a massive corporation or just trying to manage
19:20
your own personal life online, this entire incident
19:23
reinforces the absolute necessity of critical
19:26
thinking. Absolutely. Quest contained this specific
19:29
incident swiftly and their playbook was solid.
19:32
But the genie is permanently out of the bottle
19:35
for those 1 .5 million records. That data is
19:38
out there circulating in the dark, which means
19:40
you must question every unexpected digital interaction.
19:43
You have to. If an email creates a sudden sense
19:46
of urgency, if it asks you to verify something,
19:49
even if it has your actual home address and your
19:51
exact date of birth paused, close the email,
19:54
go directly to the company's verified website
19:56
yourself. Never trust the context provided in
19:59
the message. It is all about keeping that guard
20:01
up constantly. But I want to leave you with a
20:03
final lingering question to ponder on your own.
20:05
We talked extensively about how personal data,
20:08
your legal name, your date of birth, your physical
20:10
history cannot be reset like a password. Yet
20:13
we generate so much of this highly sensitive
20:15
data every single day just to exist in modern
20:18
society. Building on the report's point that
20:21
this data is unchangeable, what happens when
20:23
our digital footprint inevitably outlives the
20:25
companies that initially collected it? That's
20:27
a scary thought. Right. Will the digital ghosts
20:30
of our old hotel stays, our long -canceled software
20:33
subscriptions, and our forgotten online purchases
20:36
become permanent, unchangeable liabilities? Are
20:39
they just sitting in unknown, bankrupt vendor
20:42
databases? waiting to be weaponized decades from
20:44
now, it is a wild, unsettling thought to navigate.
20:47
Thank you so much for joining us on this deep
20:49
drive. Stay curious, stay vigilant, and always
20:52
watch out for those side doors.