QuestionPro data breach: 22.2M accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2022-08-05
In May 2022, the survey website QuestionPro was the target of an extortion attempt relating to an alleged data breach. Over 100GB of data containing 22M unique email addresses (some of which appear to be generated by the platform), are alleged to have been extracted from the service along with IP addresses, browser user agents and results relating to surveys. QuestionPro would not confirm whether a breach had occurred (although they did confirm they were the target of an extortion attempt), so the data was initially flagged as "unverified". Subsequent verification by impacted HIBP subscribers later led to the removal of the unverified flag. Exposed data: browser user agent details, email addresses, ip addresses, survey results. The breach dates from May 21, 2022; Have I Been Pwned loaded it on Aug 5, 2022.
What to do
- If you had a QuestionPro account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
Sources
All live incidents on Threat Watch
