Questel questel.com Questel data breach: what happened and what to do
In August 2026, French IP software company Questel was hit by a ShinyHunters extortion campaign after a voice phishing attack. Have I Been Pwned counts 1.2 million email addresses, mostly sales and support contacts, with names, employers, job titles, phones and addresses.
View all 13,115 breaches- Breach date
- Aug 2026
- Affected
- 1,226,209
- Data exposed
- Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Support tickets
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Questel is a French company that sells intellectual property software and services. In August 2026 the ShinyHunters group listed it in a "pay or leak" extortion campaign and published data after its deadline passed.
Questel confirmed a voice phishing attack, according to CyberInsider and SQ Magazine. The company said it found unauthorized access to a Sales SharePoint environment in its Microsoft 365 setup, that the access has been contained and that its production systems were not affected. It acknowledged that some of the data has been published online and said it could not confirm all of the group's claims. One report says it informed CNIL, the French data regulator, and filed criminal complaints.
How many people
The group claimed more than 21 million records. Have I Been Pwned counted 1,226,209 unique email addresses, about 1.2 million. Use the Have I Been Pwned count.
What was exposed
Have I Been Pwned lists email addresses, employers, job titles, names, phone numbers, physical addresses and support tickets. The data is largely corporate contact information tied to sales leads, support cases and marketing, so most people in it are professionals who dealt with Questel, such as patent attorneys, researchers and corporate IP staff.
What that lets criminals do
A business contact list with names, titles, employers and phone numbers is ideal for spear phishing, where the message is written for you. A scammer can pretend to be a Questel account manager, a patent office or a partner firm, and mention a real support case or a real deadline. Support tickets add context that makes it convincing.
Because the people in the data work in intellectual property, the messages may target things like invoices, renewal fees and filing deadlines. That is a classic business email scam pattern.
The company's response
Questel says it contained the unauthorized access and that production systems were not affected. It has not said how many people it considers affected, and it has not described what categories of data were taken beyond the SharePoint environment.
Why corporate contact data is valuable
Sales and support records show who deals with whom, and about what. Criminals use that map to impersonate a vendor or a client. The company named in the message is real and so is the contact, which is why these attacks beat spam filters and trained eyes more often than a generic phishing email.
If you work with Questel
Treat any unexpected email about invoices, renewals or filings with caution, even if it quotes real details. Confirm payment changes by phone using a number you already hold. Tell your security team if you got a message that looks like part of this.
What to do if you were in it
- 1
Verify payment and filing requests by phone
Spear phishing aimed at IP professionals often targets invoices, renewal fees and deadlines. Use a number you already have, not one in the message.
- 2
Treat messages that quote support tickets as suspect
Support ticket data leaked. A real-looking reference to an earlier case is not proof a message is real.
- 3
Be careful with phone calls
Questel itself was breached by a voice phishing call. Don't give credentials or one-time codes to anyone who phones you, even if they know your role.
- 4
Tell your IT or security team
If you use a work address with Questel, flag it. They can warn colleagues and check for related phishing.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data appears. It can't take data out of a breach, but it shows you what leaked and what to do about it.
Frequently asked
Was I affected by the Questel breach?
If you were a customer, lead or support contact of Questel, possibly. Search your email on Have I Been Pwned, which holds 1.2 million addresses from the data.
What was exposed?
Have I Been Pwned lists email addresses, employers, job titles, names, phone numbers, physical addresses and support tickets.
How did the attackers get in?
Questel confirmed a voice phishing attack that led to unauthorized access to a Sales SharePoint environment in its Microsoft 365 setup.
Should I change my password?
Passwords are not listed among the exposed data. If you reuse a password, change it, and turn on two-factor login.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
