QuestionPro Breach Exposes 22 Million Accounts and Survey Data
What Happened – In May 2022 the online survey platform QuestionPro was the target of an extortion attempt. Over 100 GB of data containing 22,229,637 unique email addresses, IP addresses, browser user‑agent strings and survey responses were extracted from the service. The breach was initially flagged as “unverified” by Have I Been Pwned but later confirmed after subscriber verification.
Why It Matters for Trust & Control Assurance
- Highlights the need for continuous privacy‑control assurance — documented consent, encryption, and audit‑ready evidence of data‑handling practices.
- Demonstrates how a data‑exfiltration event can undermine defensible audit trails required for GDPR, CCPA or other privacy frameworks.
- Shows the value of a platform that continuously monitors data‑exposure controls and provides proof of compliance.
Who Is Affected – SaaS survey providers, enterprises that collect customer feedback via QuestionPro, and any organization whose users’ personal data were stored on the platform.
Recommended Actions
- Verify that all personal data at rest and in transit is encrypted.
- Implement and document explicit consent mechanisms for survey participants.
- Update incident‑response playbooks to include data‑exfiltration scenarios.
- Conduct a privacy impact assessment aligned with GDPR/CCPA requirements.
Technical Notes – The breach was discovered through an extortion attempt; the exact attack vector remains unknown. Exfiltrated data includes email addresses, IP addresses, browser user‑agent details and survey results. Source: [Have I Been Pwned API]