In August 2026, French intellectual property software and services company Questel was hit by a ShinyHunters extortion campaign. After the company apparently declined to pay, the group published a large corpus of allegedly stolen data covering roughly 1.2 million unique email addresses tied to sales leads, support cases, and marketing activity.
Beyond emails, the exposed records included names, employers, job titles, physical addresses, and phone numbers. While no passwords or credentials were reported in this dataset, the combination of corporate email addresses with employer and role information is valuable for targeted phishing and social engineering aimed at gaining a foothold into enterprise identity systems.
What to take away: Even breaches without direct credential exposure feed attacker reconnaissance. Security teams should watch for spear-phishing against exposed employees and reinforce MFA and identity monitoring, since these leaked details make convincing impersonation and account-takeover attempts far easier.