McGraw Hill breach exposes 13.5 million email addresses after extortion
McGraw Hill data published after extortion contained 13.5 million email addresses and some names, addresses and phone numbers. The company says it secured the exposed webpages. Check your email on Have I Been Pwned and verify unexpected messages directly.
Check your email address on Have I Been Pwned. Treat unexpected McGraw Hill emails, texts or calls cautiously, and verify requests through the company’s website or a known contact before sharing information or paying. There is no device update to install for this breach.
What’s happening
McGraw Hill, the education publisher, confirmed unauthorised access to data through a misconfigured Salesforce-hosted webpage in April 2026. Following an extortion attempt attributed to ShinyHunters, more than 100GB of files became public. Have I Been Pwned counted 13.5 million unique email addresses, with names, physical addresses and telephone numbers appearing in some records. McGraw Hill said its Salesforce accounts, customer databases, courseware and internal systems were not accessed, and that Social Security numbers, financial account information and student data from its educational platforms were excluded. Mozilla Monitor says passwords were not exposed. The company said it secured the affected webpages immediately; this cannot undo publication of the copied data. Settlement Insight’s October update reports that a proposed class action was withdrawn in May and no settlement existed. As at 3 November, the reviewed sources do not establish whether everyone affected was directly notified or whether the leaked details have been used in subsequent scams.
- What
- Breach
- Affects
- McGraw Hill data on Salesforce-hosted webpages
- Fixed in
- Nothing to patch
- Since
- 10 Apr 2026
- Closed
- 21 May 2026
Timeline
- Update
Settlement Insight reports that the court closed the case. Its status report, updated on 8 October, says there was no settlement or compensation claim process.
- Update
According to Settlement Insight, the plaintiff voluntarily dismissed the proposed class action.
- Update
Settlement Insight reports that a proposed class action, Hurtado v. McGraw-Hill, was filed in the Southern District of Ohio under case number 2:26-cv-00469.
- Update
Have I Been Pwned added the breach after more than 100GB of files were publicly distributed. It counted 13.5 million unique email addresses, with names, physical addresses and telephone numbers present in some records.
- Made public
McGraw Hill confirmed unauthorised access through a misconfigured Salesforce-hosted webpage and said it had secured the affected pages. ShinyHunters had threatened publication by 14 April, claiming 45 million records; that was the attackers’ figure.
- UpdateNothing to patch
Mozilla Monitor dates the McGraw Hill breach to 10 April. Its record lists email addresses, names, telephone numbers and physical addresses as exposed.
Sources
- McGraw-Hill confirms data breach following extortion threat — includes McGraw Hill’s statementBleepingComputer · 14 Apr 2026
- McGraw Hill Data BreachHave I Been Pwned · 16 Apr 2026
- McGraw Hill Data BreachMozilla Monitor · 16 Apr 2026
- Data breach at edtech giant McGraw Hill affects 13.5 million accountsBleepingComputer · 16 Apr 2026
- Educational company McGraw Hill says Salesforce misconfiguration led to data leakThe Record · 15 Apr 2026
- McGraw Hill Data Breach: What the mheducation Leak Actually ExposedSettlement Insight · 8 Oct 2026