Questo, Inc.
bd_1b7a85c31a3fd63b · schema v1 · pii pii-v1
Full breach record for Questo, Inc. →Questo, Inc. disclosed a security incident occurring between October 1 and October 9, 2025, where an unauthorized actor accessed files containing personal information. The breach was detected and reported on June 22, 2026. Questo engaged outside cybersecurity professionals, secured its network, and is offering 24 months of identity monitoring via Kroll to affected individuals. No evidence of identity theft was found.
J jump to incidentP pin to compareR raw source
Incident timeline
Oct 1, 2025
Begins
Jun 22, 2026
Discovered
Jul 17, 2026
Filed
vs. sector median
15 wks faster
Linked disclosures
Why this link?Regulatory filings (5) · sorted by filing gap
- Texas State AGbd_6a303fe2629f33262026-07-17Verified
- California State AGbd_a5c6ff979e16a9d82026-07-16 · +1dCandidate
- Nebraska State AGbd_0a81a18aa78e777d2026-07-15 · +2dVerified
- Vermont State AGbd_748d4d39d0e167ff2026-07-22 · +5dVerified
Show 1 more filing ↓Show fewer ↑up to 6d gap
- New Hampshire State AGbd_b7acf1d77c834d252026-07-23 · +6dVerified
Filing propagation · 6 filings · 6 states
View merged incident ↗Pattern: first filing Jul 15 (NE), last Jul 23 (NH) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.