Data breach at edtech giant McGraw Hill affects 13.5 million accounts

Published:

16 april 2026 om 10:35:09

Alert date:

16 april 2026 om 11:01:14

Source:

bleepingcomputer.com

Data Breach & Exfiltration, Cloud & Virtualization, Enterprise Applications

The ShinyHunters extortion group breached McGraw Hill's Salesforce environment and leaked data from 13.5 million user accounts. This represents a significant data breach affecting a major educational technology company, exposing sensitive information of millions of users including students and educators. The breach demonstrates the continued threat posed by extortion groups targeting large organizations through cloud platform vulnerabilities.

Technical details

ShinyHunters exploited a misconfiguration in McGraw Hill's Salesforce environment to steal data from 13.5 million user accounts. The attack was part of a broader Salesforce misconfiguration issue affecting multiple organizations. The breach exposed over 100GB of data containing names, physical addresses, phone numbers, and email addresses. The incident did not affect McGraw Hill's internal Salesforce accounts, courseware, customer databases, or internal systems.

Mitigation steps:

Organizations using Salesforce should review their configurations to prevent similar misconfigurations. Users should be aware of potential spear-phishing attacks using the exposed personal information including names, addresses, phone numbers, and email addresses.

Affected products:

McGraw Hill Salesforce environment
Salesforce platform

Related links:

Related CVE's:

Related threat actors:

ShinyHunters

IOC's:

This article was created with the assistance of AI technology by Perceptive.