Questel Breach Exposes 1.2M Corporate Contacts in ShinyHunters Extortion Campaign
What Happened — In August 2026, the “pay‑or‑leak” extortion group ShinyHunters claimed to have obtained data from Questel, a French intellectual‑property software provider, and published a corpus of 1,226,209 records. The leaked set includes corporate email addresses, names, employers, job titles, phone numbers, physical addresses and support‑ticket details.
Why It Matters for Trust & Control Assurance —
- The incident exemplifies a third‑party data‑exfiltration scenario that a continuous vendor‑risk program is designed to detect, assess and document.
- Maintaining up‑to‑date evidence of a supplier’s security controls (encryption, logging, privileged‑access reviews) provides a defensible audit trail and reduces surprise exposure.
- Rapid breach‑notification clauses and documented incident‑response playbooks are essential to meet regulatory expectations and protect stakeholder trust.
Who Is Affected — Companies that rely on Questel’s IP‑management SaaS platform, including technology firms, legal/IP consultancies, pharma and manufacturing enterprises with sales‑lead data.
Recommended Actions —
- Trigger a third‑party risk review of Questel; request recent audit artifacts (SOC 2, ISO 27001) and evidence of encryption at rest.
- Verify that access to contact data is logged and that privileged accounts are protected with MFA and regular review.
- Update contracts to enforce 24‑hour breach‑notification obligations and include rights to audit security controls. Source: https://haveibeenpwned.com/api/v3/breach/Questel
Technical Notes — The breach involved the unauthorized extraction of corporate contact information; no specific software vulnerability or CVE was disclosed. The attack vector appears to be a compromise of Questel’s internal systems, details remain unknown. Source: https://haveibeenpwned.com/api/v3/breach/Questel