QuestionPro, a leading online survey solutions company that allows businesses to create and conduct surveys for market research purposes, has suffered an extortion attempt when a threat actor demanded a ransom after allegedly exfiltrating data. QuestionPro has stated that an investigation is underway to determine whether a data breach occurred, and that customers will be informed if so. The threat actor, known as “pompompurin”, claims to have stolen the QuestionPro database and allegedly alerted the company of the unsecured database in late May 2022. BleepingComputer explained, however, that an additional threat actor is involved who attempted to extort the company. Have I Been Pwnd (HIBP) owner Troy Hunt explained that the database contains records for roughly 22 million unique email addresses as well as IP addresses, geographic locations, and additional survey data. Due to “hundreds of thousands of entries using the @questionpro.com email addresses,” Hunt has added the currently unverified breach to HIBP’s database and QuestionPro users are recommended to review the HIBP site to ensure their email address is not present. CTIX analysts will provide an update once additional information is released.