An Australian hotel group's guest data was exposed last month — not through its own systems, but through a third-party provider's. Your suppliers' security is now your problem, and this post is about what to do with that fact.
In August 2026, Quest Apartment Hotels publicly disclosed a data breach traced to a vulnerability at a third-party service provider, detected on 17 August. On 16 September, Quest said its forensic analysis had confirmed that information relating to about 1.99 million customers was affected, all from records before June 2025. For most it was names and contact details; for some, passport or driver licence numbers and credit card numbers too. Quest's own booking systems weren't the way in; a supplier's were. That detail is the story. For every business that hands customer data to booking engines, payroll providers, marketing platforms and industry software vendors — which is every business — the breach you have to plan for may not happen on your network at all.
What is a third-party data breach?
A third-party data breach is when personal information your business collected is exposed through a supplier, such as a booking platform, cloud software vendor, contractor or marketing agency, rather than through your own network. In Australia that data usually remains yours to answer for, which is why Key IT helps Melbourne businesses map which suppliers hold their customer data and lock down what each one can reach.
Why are supply-chain breaches surging?
Supply-chain breaches are surging because attackers follow economics. Breaking into one supplier can yield the data of hundreds of that supplier's customers — a far better return than attacking those customers one at a time. Several of the largest Australian breaches of the past few years have followed exactly this pattern: the victim organisation's name is on the headline, but the way in was a vendor, a contractor's login, or a piece of shared software. Regulators have noticed too — the OAIC's breach reporting has repeatedly flagged third-party and supply-chain incidents as a growing share of notifications.
Are you responsible if your supplier has a data breach?
Usually, yes: "it was our supplier's fault" doesn't work. Legally and commercially, the data you collected is yours to protect, wherever it sits. If your customers' details leak from your booking platform or your marketing tool and your business is covered by the Privacy Act, the Notifiable Data Breaches scheme looks to you, your customers blame you, and your name is on the apology email. Outsourcing the processing does not outsource the accountability. That sounds harsh, but it points at the fix: you can't control a supplier's security, but you can control which suppliers you use, what you give them, and how fast you find out when something goes wrong.
The rules are getting stricter too. The draft Personal Data Protection Bill at the centre of the Privacy Act reforms 2026 would require a statement to the Information Commissioner within 72 hours of having reasonable grounds to believe an eligible data breach occurred, and would expect suppliers that handle personal information for you to work under instructions documented in writing. It is not law yet and has no start date, but it makes the supplier questions below more pressing: who handles your data on your behalf, under what written instructions, and how quickly they must tell you about a breach.
How do you reduce supply chain cyber risk?
Five controls sit with you, whoever your suppliers are: map who holds your data, give suppliers less of it, run a supplier security assessment before you sign, limit what each supplier can reach, and watch for the fallout.
Know where your data lives
Most businesses cannot list the third parties holding their customer data. Build the list — every platform, every integration, every agency with a login. You cannot manage exposure you haven't mapped.
Give suppliers less
Data a supplier never holds cannot leak from them. Question every field you sync: does the marketing platform really need dates of birth? Does the booking engine need to keep records forever?
Ask suppliers hard questions before you sign
Where is data stored, who can access it, do they hold recognised security certifications, what is their breach-notification commitment to you — in hours, not "as required by law"? Expect the same questions in reverse: insurers and larger clients now vet their suppliers, and that includes you.
Limit what a supplier's compromise can reach
Vendor logins and integrations should have the minimum access that makes them work, with multi-factor authentication and monitoring — so a breached supplier is a contained problem, not a skeleton key. This is core managed cybersecurity work.
Watch for the downstream wave
After a breach like this, the stolen data gets used: phishing emails referencing real bookings, fake "verify your details" messages, credential-stuffing against your systems. This follow-on activity is exactly what 24/7 SOC monitoring is there to catch. A free dark web scan shows whether your business email addresses already sit in breach data, and a phishing simulation shows how your team handles a convincing fake.
Which businesses should worry most about supplier breaches?
Accommodation, hospitality and retail run on exactly the kind of third-party stack this incident came through — booking engines, channel managers, POS platforms, loyalty systems — and hold exactly the kind of guest and customer data attackers resell. If that's your industry, our retail & hospitality page covers how we secure that stack, and continuous vulnerability scanning covers the internet-facing systems the attackers probe first.
Frequently asked questions
If our supplier is breached, do we have to notify anyone?
Quite possibly. If personal information you collected is involved and serious harm is likely, the Notifiable Data Breaches scheme applies to you as well as the supplier — the obligation follows the data, not the network it leaked from. Assess a suspected breach within 30 days; one notification can cover you both, so agree who sends it. The draft 2026 reforms would add a 72-hour deadline for the statement to the Information Commissioner, but they are not law yet.
Do small businesses have to report a supplier's data breach?
Not always. Most businesses with annual turnover of $3 million or less sit outside the Privacy Act, but some are covered at any size, including health service providers and businesses that trade in personal information. If you're covered, a supplier's breach of your customers' data is yours to assess and, where serious harm is likely, to report. The 2026 draft Bill keeps the $3 million small business exemption, though larger clients may still push privacy obligations onto you through their contracts.
What should we ask a supplier after they disclose a breach?
Exactly what data of yours was involved, over what period, whether it was encrypted, what the attacker did with it, what they've fixed, and what they will fund (such as customer notification). Put the answers in writing.
What is a supplier security assessment?
A structured check of a vendor before, and while, they hold your data: where it's stored, who can access it, whether multi-factor authentication and encryption are enforced, how fast they'll tell you about a breach, and how they vet their own suppliers. For a small business, a short questionnaire plus a contract breach-notification clause covers most of it.
We're a small business — can we really vet big software vendors?
You won't change a global vendor's security, but you still choose what to give them and what to switch on. Data minimisation and locked-down integrations are decisions you own at any size — and they're free.
How do we find out early that a supplier issue is affecting us?
Monitoring your own environment for unusual activity — strange logins, odd data flows from integrations — catches many supplier compromises before the supplier's own disclosure arrives. That's exactly the job of the 24/7 SOC monitoring we provide: watching client environments for the activity that gives a compromise away.
Was my data in the Quest Apartment Hotels breach?
Quest says it is contacting affected customers directly, and the data it identified comes from records before June 2025. If you stayed with Quest before then, watch for that notice and follow its advice, treat unexpected emails, texts or calls that mention a Quest stay with suspicion, and change any password you reused elsewhere.
Wondering how your own business measures up? A free IT & Cyber Security Review shows where you stand and what to fix first — no jargon, no obligation.
Book a Free Review