QuestionPro Data Breach (2022): What Was Exposed & What To Do

In May 2022, an extortion attempt targeted the survey platform QuestionPro and involved claims that more than 100 GB of data had been taken, including 22.2 million unique email addresses along with IP addresses, browser user-agent strings and survey responses. The company confirmed it had received an extortion demand but did not verify that any unauthorised access or data extraction had occurred. The dataset was initially treated as unverified until later checks by Have I Been Pwned subscribers confirmed that records matched individuals who had used the service. The incident left open questions about the scope of any compromise and the handling of data collected through online surveys.

What happened

On 21 May 2022, reports emerged that QuestionPro had been approached by an unidentified party claiming to possess a large volume of its data. The claimed material totalled more than 100 GB and was said to contain 22.2 million unique email addresses, IP addresses, browser user-agent details and the contents of completed surveys. QuestionPro stated that it had been the target of an extortion attempt but declined to confirm whether any breach had taken place. The data was therefore listed as unverified at the time of the initial reports. Subsequent checks against records held by Have I Been Pwned established that the email addresses corresponded to accounts that had interacted with the platform, moving the incident beyond an unconfirmed claim.

How a breach like this happens

Extortion attempts against online service providers often begin with unauthorised access obtained through stolen credentials, misconfigured servers or vulnerabilities in web applications. Once inside, an actor may copy large volumes of stored records and then contact the organisation with a demand for payment in exchange for not publishing or further distributing the material. In many cases the organisation confirms only that contact occurred and withholds further detail while internal investigations continue. Public disclosure of the dataset by third parties can later allow independent verification even when the affected company has not released its own statement.

About QuestionPro

QuestionPro operates an online survey and feedback platform used by businesses, researchers and public-sector organisations to collect responses from customers, employees and other audiences. The service stores participant email addresses for distribution and follow-up, records IP addresses and browser information for technical and anti-fraud purposes, and retains the answers submitted to individual surveys. Because these datasets frequently include both contact details and substantive responses on topics such as employment, health or consumer behaviour, the platform holds information that can be both identifying and contextually sensitive.

What was likely exposed

The records referenced in public reports include email addresses, IP addresses, browser user-agent strings and survey responses. The company has not published an official list of affected fields or confirmed the precise contents of any extracted material. Organisations that run survey platforms routinely collect these categories of data, yet the exact combination present in the claimed dataset remains unconfirmed beyond the attributes already named in the reports.

Why it matters

Email addresses combined with IP addresses can facilitate targeted phishing or account-takeover attempts on other services where the same credentials or recovery information are reused. Survey responses may reveal personal opinions, employment details or other information that individuals provided under an expectation of limited circulation. For the organisation, the incident highlights the volume of records held in a single environment and the difficulty of containing claims once data has left its control, regardless of whether the initial access method is ever disclosed.

If your data was in this breach

Individuals who received a notification or who suspect their address was involved should change passwords on the QuestionPro account and on any other service that uses the same email and password combination. Enabling multi-factor authentication where available reduces the value of exposed credentials. A free exposure scan of an email address against known breach datasets can indicate whether the address has appeared in this or other incidents, allowing prioritised review of affected accounts.

AICompiled with AI assistance from public sources and published under our editorial standards.