{"id":"mcgraw-hill-contact-data-breach-apr-2026","category":"breach","status":"closed","title":"McGraw Hill breach exposes 13.5 million email addresses after extortion","tldr":"McGraw Hill data published after extortion contained 13.5 million email addresses and some names, addresses and phone numbers. The company says it secured the exposed webpages. Check your email on Have I Been Pwned and verify unexpected messages directly.","summary":"McGraw Hill, the education publisher, confirmed unauthorised access to data through a misconfigured Salesforce-hosted webpage in April 2026. Following an extortion attempt attributed to ShinyHunters, more than 100GB of files became public. Have I Been Pwned counted 13.5 million unique email addresses, with names, physical addresses and telephone numbers appearing in some records. McGraw Hill said its Salesforce accounts, customer databases, courseware and internal systems were not accessed, and that Social Security numbers, financial account information and student data from its educational platforms were excluded. Mozilla Monitor says passwords were not exposed. The company said it secured the affected webpages immediately; this cannot undo publication of the copied data. Settlement Insight’s October update reports that a proposed class action was withdrawn in May and no settlement existed. As at 3 November, the reviewed sources do not establish whether everyone affected was directly notified or whether the leaked details have been used in subsequent scams.","action":"Check your email address on Have I Been Pwned. Treat unexpected McGraw Hill emails, texts or calls cautiously, and verify requests through the company’s website or a known contact before sharing information or paying. There is no device update to install for this breach.","product":"McGraw Hill data on Salesforce-hosted webpages","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["mcgraw-hill","salesforce","data-breach","extortion","education","shinyhunters"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"news","title":"McGraw-Hill confirms data breach following extortion threat — includes McGraw Hill’s statement","url":"https://www.bleepingcomputer.com/news/security/mcgraw-hill-confirms-data-breach-following-extortion-threat/amp/","by":"BleepingComputer","date":"2026-04-14"},{"kind":"research","title":"McGraw Hill Data Breach","url":"https://haveibeenpwned.com/Breach/McGrawHill","by":"Have I Been Pwned","date":"2026-04-16"},{"kind":"research","title":"McGraw Hill Data Breach","url":"https://monitor.mozilla.org/en/breach-details/McGrawHill","by":"Mozilla Monitor","date":"2026-04-16"},{"kind":"news","title":"Data breach at edtech giant McGraw Hill affects 13.5 million accounts","url":"https://www.bleepingcomputer.com/news/security/data-breach-at-edtech-giant-mcgraw-hill-affects-135-million-accounts/","by":"BleepingComputer","date":"2026-04-16"},{"kind":"news","title":"Educational company McGraw Hill says Salesforce misconfiguration led to data leak","url":"https://therecord.media/mcgraw-hill-data-leak-tied-to-salesforce-misconfiguration","by":"The Record","date":"2026-04-15"},{"kind":"post","title":"McGraw Hill Data Breach: What the mheducation Leak Actually Exposed","url":"https://settlementinsight.com/mcgraw-hill-data-breach","by":"Settlement Insight","date":"2026-10-08"}],"started":"2026-04-10","closed":"2026-05-21","created":"2026-11-03T21:15:25.988Z","updated":"2026-11-03T21:15:25.988Z","cve_notes":[],"timeline":[{"at":"2026-05-21","added":"2026-11-03T21:11:13.172Z","kind":"other","text":"Settlement Insight reports that the court closed the case. Its status report, updated on 8 October, says there was no settlement or compensation claim process.","url":"https://settlementinsight.com/mcgraw-hill-data-breach","by":"Settlement Insight","patch":null},{"at":"2026-05-05","added":"2026-11-03T21:11:13.172Z","kind":"other","text":"According to Settlement Insight, the plaintiff voluntarily dismissed the proposed class action.","url":"https://settlementinsight.com/mcgraw-hill-data-breach","by":"Settlement Insight","patch":null},{"at":"2026-04-17","added":"2026-11-03T21:11:13.172Z","kind":"other","text":"Settlement Insight reports that a proposed class action, Hurtado v. McGraw-Hill, was filed in the Southern District of Ohio under case number 2:26-cv-00469.","url":"https://settlementinsight.com/mcgraw-hill-data-breach","by":"Settlement Insight","patch":null},{"at":"2026-04-16","added":"2026-11-03T21:11:13.172Z","kind":"other","text":"Have I Been Pwned added the breach after more than 100GB of files were publicly distributed. It counted 13.5 million unique email addresses, with names, physical addresses and telephone numbers present in some records.","url":"https://haveibeenpwned.com/Breach/McGrawHill","by":"Have I Been Pwned","patch":null},{"at":"2026-04-14","added":"2026-11-03T21:11:13.172Z","kind":"disclosed","text":"McGraw Hill confirmed unauthorised access through a misconfigured Salesforce-hosted webpage and said it had secured the affected pages. ShinyHunters had threatened publication by 14 April, claiming 45 million records; that was the attackers’ figure.","url":"https://www.bleepingcomputer.com/news/security/mcgraw-hill-confirms-data-breach-following-extortion-threat/amp/","by":"BleepingComputer","patch":null},{"at":"2026-04-10","added":"2026-11-03T21:11:13.172Z","kind":"other","text":"Mozilla Monitor dates the McGraw Hill breach to 10 April. Its record lists email addresses, names, telephone numbers and physical addresses as exposed.","url":"https://monitor.mozilla.org/en/breach-details/McGrawHill","by":"Mozilla Monitor","patch":"na"}],"url":"https://hard.fyi/live/mcgraw-hill-contact-data-breach-apr-2026/","json":"https://hard.fyi/api/live?id=mcgraw-hill-contact-data-breach-apr-2026"}