QuestionPro Inc. Data Breach Notice (Massachusetts Attorney General)

The exposure of your Social Security number and financial account numbers cannot be undone. For the two Massachusetts residents named in this filing, those identifiers are now outside the organisation’s control and remain permanently valuable to identity thieves.

A Social Security Number Cannot Be Replaced

Unlike a credit card or password, a Social Security number does not expire and cannot be reissued on request. Once it leaves the organisation’s systems, it stays exposed for the rest of your life. The filing from QuestionPro Inc., submitted to the Massachusetts Attorney General on August 18, 2026, lists Social Security numbers among the data involved in the incident. No passwords were exposed.

Financial account numbers add another permanent risk. With a matching Social Security number, thieves can attempt to open new accounts, file fraudulent tax returns, or impersonate you in transactions that rely on those two pieces of information together. The record does not state whether the data was copied or simply viewed, but the categories themselves are what matter to you now.

What the Two-Person Filing Actually Covers

This notice concerns exactly two people. The small number does not reduce the seriousness for those affected; it simply reflects the scope disclosed in the official record. The filing does not name a separate incident date, so the only reliable way to determine whether you are one of the two individuals is the notification QuestionPro is required to send directly, usually by post.

If you have not received a letter, it is likely your information was not included. However, letters can go to outdated addresses. Anyone who has moved since the time the records were held by QuestionPro should contact the company directly to confirm their status. Absence of a letter is meaningful but not absolute proof.

Why These Specific Categories Matter Long-Term

Social Security numbers and financial account numbers form the core of most identity-theft schemes because they are difficult to change and easy to monetise. A thief who obtains both can:

• Apply for loans or credit cards in your name
• File a fraudulent tax return to claim refunds before you do
• Access or redirect existing financial accounts
• Build a synthetic identity using your number as the anchor

These risks do not disappear after 30 or 90 days. The value of a Social Security number on the criminal market persists for years precisely because it cannot be rotated like a password.

The Organisation’s Notification Obligation

QuestionPro Inc. filed this notice on August 18, 2026. Massachusetts law requires organisations to notify affected residents directly when Social Security numbers are involved. That direct notification remains the definitive answer for whether your records were included. The filing itself does not disclose the root cause, whether any data was exfiltrated, or the precise timing of the underlying events.

What You Can Still Control

While the exposed identifiers cannot be changed, your response to them can limit the damage. The most effective steps focus on detection and blocking rather than prevention of something that has already occurred.

Place a freeze on your credit files with the three major bureaus. This prevents new accounts from being opened in your name without your explicit permission. The freeze is free, reversible when you need to apply for credit, and one of the strongest controls available after a Social Security number breach.

Monitor your tax filings closely. Set up an IRS online account and consider filing Form 14039, an Identity Theft Affidavit, if you see signs of fraudulent returns. Early filing of your own legitimate return can sometimes prevent a thief from claiming a refund first.

Review every financial statement and Explanation of Benefits for accounts you actually hold. Look for transactions you do not recognise. Even small test charges can signal that someone is probing stolen account numbers.

Consider requesting an extended fraud alert, which lasts one year and requires creditors to verify your identity before issuing new credit. If you have already been a victim of identity theft, you can request a seven-year alert.

The Limits of What This Filing Tells Us

The record does not establish how the information was accessed, how long it may have been at risk, or whether the organisation followed any particular security practice. It simply documents that Social Security numbers and financial account numbers for two Massachusetts residents were exposed. Speculation beyond those facts is not supported by the official notice.

For the individuals named, the breach creates a lifelong monitoring task rather than a one-time event. The absence of exposed passwords is genuine good news: there is no need to reset credentials for QuestionPro or any linked accounts on the basis of this incident. The permanent fields are the ones that require ongoing attention.

The letter from QuestionPro remains the clearest signal of whether you are personally affected. If one arrives, treat the enclosed details as confirmation and begin the monitoring steps immediately. If none arrives and you have reason to believe your records were with the company, contact them directly. In either case, the practical reality is the same: a Social Security number that has left an organisation’s custody stays valuable to criminals indefinitely, and the only protection is vigilance layered on top of the credit freeze, tax monitoring, and account review you put in place now.