Incidents
Wed 19 Aug
Updated Fri 23 Oct
Quest Apartment Hotels (Ascott Australasia) identified the incident on 17 August 2026 after a website outage investigation showed a threat actor exploited a vulnerability in a third-party service provider and accessed Quest’s environment; Quest says the incident was contained and systems secured. Managing Director update (16 September 2026 PDF / update page) states forensic analysis found information relating to approximately 1,991,613 customers, all from records before June 2025. Beyond name/address/phone/email contact fields, Quest publishes category counts: vehicle registration 225,300; passport and/or driver licence number only (no scanned ID images) 104,268; credit card number without CVV (incl. expired) 297,739; credit card number with CVV (incl. expired) 46,727; date of birth 3,328; NDIS number 271; Medicare card number 46. Not every category applies to every person; Quest is notifying individuals in stages. Quest says it has notified and continues to cooperate with OAIC, ASD, ACSC and Victoria Police. Separate 23 September 2026 passport/licence clarification (company PDF): where an Australian passport number was affected, Quest cites Australian Passport Office advice that the passport remains safe to use for international travel (number alone cannot obtain a new passport; APO facial-recognition controls); where a driver licence number was affected, Quest says consider contacting the relevant state/territory roads authority. Updated customer FAQ PDF dated 23 September 2026. ABC News (22 September 2026 UTC) reported customer SMS/email notices and earlier advice that prompted some guests to reissue licences/cards; treat ABC as secondary to Quest’s own PDFs. (source: Quest /update hub) UPDATE (23 Oct 2026): Quest's update page links a 25 September 2026 scam alert saying customers have received unsolicited emails and WhatsApp messages impersonating Quest that ask them to confirm an upcoming booking by clicking a link; Quest says not to click the link or call the number in the message, and to contact the hotel directly using the details on the Quest website. The alert does not say whether these messages are connected to the data breach. (source: Quest (questapartments.com.au))
Quest — update hub + 16 Sep forensic MD statement + 23 Sep passport/licence PDF
breaches supply chain australia
Incidents
Tue 18 Aug
Updated Sat 31 Oct
The Essendon-headquartered SIA Medical Centre, a Victorian medical centre, has said it is investigating a cyber security incident after hackers claimed to have accessed sensitive patient data, Cyber Daily reported on 18 August 2026. “SIA Medical is aware of a cyber incident involving unauthorised access to a portion of its systems,” an SIA spokesperson told Cyber Daily. Rhysida claimed the attack, according to Cyber Daily. (source: Cyber Daily) Correction (31 Oct 2026): removed material from the login-only part of Cyber Daily's report; the card now carries only what the readable part states. (source: Cyber Daily)
Cyber Daily (18 Aug 2026)
australia identity
Incidents
Tue 18 Aug
Updated Thu 29 Oct
Brighton East Dental Clinic's official notice says ASD's ACSC alerted it on 13 August 2026 to a potential incident. On 17 August 2026 the clinic identified unauthorised access to data on on-premises file servers through its firewall, contained that access, and analysed leaked data. It assesses the access occurred in early April 2026 and involves records from before April 2026: patient contact details (name, address, date of birth, email, mobile), treatment plans, oral X-rays, referrals and treatment history, and private health insurance membership numbers. The clinic has not published a count of affected records. It says it notified OAIC, ACSC and Victoria Police, partnered with IDCARE, and that remediation is complete. This Cyberstack does not take actor names or leak sizes from secondary leak-site indexes. Correction (29 Oct 2026): the card date has moved from 17 to 18 August 2026, the date of Cyber Daily's report ("Tue, 18 Aug 2026"), the earliest linked source that shows a date. (source: Cyber Daily)
Brighton East Dental Clinic notice
breaches australia
Incidents
Thu 13 Aug
Updated Sun 1 Nov
Nick Scali Limited's 13 August 2026 ASX release says it is investigating a security incident and elected to take certain systems offline. The company said it was bringing those systems back online, continuing to complete sales orders and deliveries, with slower-than-normal customer response times. At the time of the release, Nick Scali said it did not have any evidence of unauthorised access to customer data. It notified the Australian Cyber Security Centre and the Australian Federal Police, and said further updates would follow as appropriate. The Sydney Morning Herald (13 Aug) reported that chief executive Anthony Scali said the incident happened 'about mid-last week' and that staff were referring to manual records to get in touch with customers whose orders had been affected. UPDATE (22 Oct 2026): in an email to customers reported by the NZ Herald on 10 September, Nick Scali said details on sales orders, including name, email address, delivery address and phone number, were affected, and that no credit card details are recorded on sales orders because card payments go through a third-party provider. In its 21 October 2026 ASX trading update, Nick Scali said the incident left its ERP systems unavailable for about three weeks, with stores processing sales orders manually, and that about $980,000 of direct consultant and legal costs will be reported outside underlying net profit. Capital Brief, citing The Australian, reported that Nick Scali hired an intermediary to negotiate; Nick Scali has not confirmed this in its ASX releases. CORRECTION (22 Oct 2026): this card earlier said customer-data access was not verified; Nick Scali has since told customers that sales-order details were affected (source: NZ Herald, 10 Sep 2026). Correction (01 Nov 2026): removed attacker claims that no company, regulator or outlet independently confirmed. (source: Capital Brief)
Nick Scali ASX trading update (21 Oct 2026)
australia retail
Incidents
Wed 24 Jun
Updated Tue 27 Oct
Aesto Health (Birmingham, Alabama), which provides healthcare data migration and archiving for covered-entity clients, posted a notice dated 24 June 2026: it discovered a network security incident on or about 18 December 2025 affecting a limited portion of its Amazon Web Services infrastructure. On 26 May 2026 the investigation determined that PII and PHI belonging to patients of various clients may have been accessed or acquired between about 2 and 18 December 2025, including names, dates of birth, medical information, driver's licence numbers, financial account numbers, health insurance information, taxpayer identification numbers, other government IDs, and Social Security numbers (elements varied; SSNs for a limited number of people). The company says it has no evidence of identity theft or financial fraud tied to the incident. No Australia link is reported. Updated 1 Sep 2026 (BleepingComputer): BleepingComputer reports that in a report to the US Department of Health and Human Services, Aesto Health said the breach affects 9,540,683 individuals, and that Aesto began notifying affected people on 21 August. (source: BleepingComputer) Correction (27 Oct 2026): the card date has moved from 31 August to 24 June 2026, the date on Aesto's notice; the SecurityWeek link, the HHS listing date and a count of affected provider clients that only SecurityWeek gave have been removed, and the 9,540,683 figure is now credited to BleepingComputer. (source: BleepingComputer)
Aesto Health notice of data security incident (24 Jun 2026)
breaches cloud
Incidents
Mon 8 Jun
Updated Thu 29 Oct
The University of Western Australia's own notice says that on 28 May 2026, UWA IT identified unauthorised external access to Callista, the university's Student Information Management System, after system access credentials were unintentionally exposed online. UWA says it secured the system and removed the vulnerability. Exposed fields, on that notice, include name, UWA student ID, UWA staff ID if applicable, home and mobile numbers, date of birth (day and month only), personal email, postcode, and enrolment status as at 2 April 2026, for some prospective students, current students and recent graduates. UWA says financial details were not involved, that it found no evidence of malicious use, and that it emailed affected people on 8 June 2026. UWA password resets were not required. (source: UWA) Correction (29 Oct 2026): removed an unsourced statement about ASD's ACSC alerts and a duplicate UWA link. (source: UWA)
UWA Callista notice
breaches australia
Incidents
Thu 7 May
Updated Sat 24 Oct
Instructure detected unauthorised activity in Canvas on 29 April 2026 and a second access on 7 May 2026 that changed pages some students and teachers saw after login. The vendor says both used a Free-For-Teacher account path, took Canvas into maintenance, remediated the privilege-escalation routes, and permanently discontinued Free-For-Teacher. Fields named on the vendor FAQ include usernames, email addresses, course names, enrolment information, and messages; Instructure says core learning data (course content, submissions, credentials) was not compromised, and the US Education Department FSA alert (12 May, updated 29 May) repeats that there is no evidence passwords, dates of birth, government identifiers, or financial information were exposed. The US Education Department's FSA alert says a ransomware group identified as ShinyHunters claimed responsibility and repeatedly defaced Canvas login pages with ransom demands; Instructure later said it reached an agreement with the unauthorised actor, that data was returned with shred logs, and that customers should not engage the actor. Patch posture for customers: rotate Canvas integrations, LTI tools, SSO connectors, and API keys; review logs for 25 April–8 May 2026. Correction (24 Oct 2026): removed data-volume and institution counts that no linked source supports, and attributed the ShinyHunters claim to the US Education Department's FSA alert. (source: US Dept of Education FSA alert)
Instructure Security Incident Update & FAQs
australia cloud identity
