QuestionPro questionpro.com QuestionPro data breach: what happened and what to do
In May 2022, survey platform QuestionPro was the target of an extortion attempt over an alleged breach of about 22 million email addresses, with IP addresses, browser details and survey results. QuestionPro hasn't confirmed a breach.
View all 13,115 breaches- Breach date
- 21 May 2022
- Affected
- 22,229,637
- Data exposed
- Browser user agent details, Email addresses, IP addresses, Survey results
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
QuestionPro is an online survey platform. In May 2022 it was the target of an extortion attempt tied to an alleged data theft. BleepingComputer reported that attackers tried to extort the company over data they said they had taken.
Have I Been Pwned lists 22,229,637 unique email addresses from the data. QuestionPro confirmed the extortion attempt but did not confirm a breach, so the entry was first flagged unverified. People whose data was in it later confirmed it was real, and the flag was removed. Some of the addresses appear to be generated by the platform itself.
What was exposed
The data includes email addresses, IP addresses, browser user agent details and survey results. No passwords are listed.
Survey results can be personal. Depending on the survey, answers may reveal opinions, workplace feedback or customer details tied to your email. Together with your email address, that makes targeted phishing easier.
What to do
You don't need to reset a password for this one. Be wary of messages that mention a survey you took, and be careful with any survey you answered under your real email.
What to do if you were in it
- 1
Expect phishing that uses these details
Expect emails that mention a survey, a prize or your answers. Don't click links in them. Go to the survey provider's site yourself.
- 2
Use a separate email for surveys
An alias or a secondary address keeps survey responses away from your main inbox and makes leaks easier to trace.
- 3
Turn on two-factor login on accounts tied to this email
If your email address is public, an authenticator app or passkey protects the accounts behind it.
- 4
Check whether your email or phone is in this and other breaches
A free Serus scan checks breach databases for your email, phone and other details, and Serus alerts you when they show up in a new leak. It can't remove breach data, so the steps above are what protect you.
Frequently asked
Did QuestionPro confirm the breach?
QuestionPro confirmed it was the target of an extortion attempt but would not confirm a breach. Have I Been Pwned removed the unverified flag after affected subscribers confirmed the data was real.
What was exposed?
Email addresses, IP addresses, browser user agent details and survey results, per Have I Been Pwned.
Should I change my password?
No passwords are listed. Changing a QuestionPro password is cheap if you still use the service, and necessary if you reused it elsewhere.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
