QuestionPro Data Breach

What happened?

In May 2022, the survey website QuestionPro was the target of an extortion attempt relating to an alleged data breach . Over 100GB of data containing 22M unique email addresses (some of which appear to be generated by the platform), are alleged to have been extracted from the service along with IP addresses, browser user agents and results relating to surveys. QuestionPro would not confirm whether a breach had occurred (although they did confirm they were the target of an extortion attempt), so the data was initially flagged as "unverified". Subsequent verification by impacted HIBP subscribers later led to the removal of the unverified flag.

When did it happen?

The breach date in the public record is May 21, 2022. The record was added to the catalogue on August 5, 2022 and last updated there on August 5, 2022.

What information was reported as exposed?

• Browser user agent details
• Email addresses
• IP addresses
• Survey results

These are incident-level categories. The record does not prove that every category was exposed for every affected person.

Who may be affected?

This record may be relevant to people who had an account or other relationship with QuestionPro or used questionpro.com around May 21, 2022. A catalogue entry does not establish that every customer was affected or that every listed data category applied to each person. Compare the record with an official notice addressed to you.

What should you do?

Choose actions that match the information involved. If you find signs that someone is using your identity, the Federal Trade Commission provides a personal recovery plan at IdentityTheft.gov.