HackingTechnologyInformationCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancial accountMediumContained

Questo, Inc.

bd_b7acf1d77c834d25 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 9, 2025

Filed

Jul 23, 2026

To disclose

41 weeks

Affected

7state residents only

Linked

6 filings

Confidence

66%

Full breach record for Questo, Inc. →

Questo, Inc. notified the NH Attorney General of unauthorized access to its network affecting approximately 7 New Hampshire residents. The incident occurred between October 1 and October 9, 2025, and was discovered on October 9, 2025. Affected data includes full names, Social Security numbers, and financial account numbers. Questo contained the incident, engaged outside cybersecurity professionals, and is providing complimentary identity monitoring through Kroll to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 8 days

discovery → filing · 41 weeks / 287 days

Oct 1, 2025

Begins

Oct 9, 2025

Discovered

Jul 23, 2026

Filed

vs. sector median

+22 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Vermont State AGbd_748d4d39d0e167ff2026-07-22 · +1dVerified
Massachusetts State AGbd_1b7a85c31a3fd63b2026-07-17 · +6dVerified
Texas State AGbd_6a303fe2629f33262026-07-17 · +6dVerified
California State AGbd_a5c6ff979e16a9d82026-07-16 · +7dCandidate

Show 1 more filing ↓up to 8d gap

Nebraska State AGbd_0a81a18aa78e777d2026-07-15 · +8dVerified

Name: Questo, Inc.
norm: questo

Name: Questo, Inc.
norm: questo
Industry: Technologyllm

Discovered: Oct 9, 2025
Breach occurred: Oct 1, 2025 – Oct 9, 2025
Undetected for: 8 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 15, 2026
Affected individuals: 7state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unknown
Threat actor: External
Regulator citations: Notified Office of the New Hampshire Attorney General Consumer Protection Bureau

During the incident: Immediately took action to contain the incident
Commenced a prompt and thorough investigation
Secured our network
Launched an investigation in consultation with outside cybersecurity professionals
Provided affected residents with written notification
Provided contact information for consumer reporting agencies and the Federal Trade Commission
Provided access to a complimentary credit monitoring membership for individuals whose Social Security number was impacted
Secured the services of Kroll to provide identity monitoring at no cost
Changes made: Continually evaluates and modifies its practices to enhance the security and privacy of the personal information it maintains
Continually evaluate and modify its practices and internal controls to enhance the security and privacy of your personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 41 weeks(287 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Nebraska State AGJul 15 · first

California State AG+1d

Massachusetts State AG+2d

Texas State AG+2d

Vermont State AG+7d

New Hampshire State AG+8d · this page

Pattern: first filing Jul 15 (NE), last Jul 23 (NH) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/questo-20260723.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 23, 2026
Raw hash: 54a2546ef7f4ed3c6f83d8e49f68782cf2a11f2c6f0f26b8898190c01f978f54

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityQuesto, Inc.

Victim entityQuesto, Inc.

Incidentdiscovered Oct 9, 2025

Stated responseImmediately took action to contain the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov