Questel 2026 Data Breach

It did not disclose when the access began, how long it lasted, or how the social-engineering attempt led to account or system access.

Questel said the unauthorized access had been contained and that there was no evidence the intruders retained access to its environment. Its production tools, intellectual-property platforms, and SaaS IP products and services were not accessed, and operations remained fully available. This separates the confirmed incident in a sales collaboration area from Questel’s customer-facing production systems.

The company also confirmed that some data obtained during the incident had been published online. A detailed forensic review was underway to identify precisely what was disclosed and to assess the material’s authenticity and completeness. Questel did not confirm the full scope of the published material. Specific data categories and affected-person or unique-record totals remain undisclosed.

Questel reported the incident to France’s data protection authority, CNIL, filed criminal complaints with the relevant law-enforcement agencies, and worked with external cybersecurity specialists. It also began contacting affected customers. The statement confines the confirmed access to Sales SharePoint; it does not show access to intellectual-property content in production systems or SaaS accounts, and it does not identify the affected individuals.