Questo, Inc. detected unusual network activity on October 9, 2025. An investigation revealed unauthorized access to certain files between October 1 and October 9, 2025. The company secured its network and engaged outside cybersecurity professionals. Identity monitoring services were provided via Kroll. The incident affected residents in multiple states, including California and Rhode Island.