McGraw Hill Data Breach 2026:
What You Need to Know
On 16 April 2026, education publisher McGraw Hill confirmed a breach stemming from a Salesforce misconfiguration. Approximately 100 GB of data containing roughly 13.5 million unique email addresses plus names and addresses was distributed.
Your personal risk from this breach
Sign in or create a free account to see your personalised risk score.
What Happened
How the McGraw Hill Breach Unfolded
Early 2026
A misconfigured Salesforce object on McGraw Hill's instance was accessible without authentication, part of a broader wave of Salesforce-data-theft attacks attributed to the ShinyHunters extortion group, which claimed it had stolen roughly 45 million Salesforce records across multiple organisations and threatened to leak the documents online unless a ransom was paid.
16 April 2026
McGraw Hill publicly confirmed the breach after approximately 100 GB of data was distributed online. The dataset contained ~13.5 million unique email addresses, plus names and physical addresses (appearing inconsistently across some records) linked to customers, prospects and institutional contacts.
Late April 2026
McGraw Hill began notifying affected customers and regulators. The company stated that no Social Security numbers, financial account information or student data from its educational platforms were contained in the exposed Salesforce object, and that it had secured the affected webpages immediately on detection.
If you are a student or instructor who has interacted with McGraw Hill marketing materials, you may be in the affected set even if you have never bought a product.
Source: McGraw Hill Newsroom
What Was Exposed
Personal Data Leaked in the Breach
The leaked Salesforce dataset is a marketing and customer- relationship database. It primarily holds contact details for customers, prospects and institutional contacts. Coursework, grades and student records were not part of the exposed object.
| Data Type | Risk Level | Who Was Affected |
|---|---|---|
| Email address | High | All approximately 13.5 million unique addresses in the dump |
| Full name | High | Most affected records |
| Physical address | High | Subset of affected records |
| Phone number | High | Subset of affected records |
| Institution / school | Medium | Records associated with educational sales contacts |
| Course / product interest | Low | Marketing-tracked records |
Risk levels based on the OAIC: What is personal information? and OAIC Australian Privacy Principles. Identity-linked data (name, physical address, phone, email) is rated High because the combination supports targeted spear-phishing at scale and is commonly used to verify identity at banks and telcos. Institution and product-interest fields are rated lower because they primarily refine attacker targeting rather than enable identity fraud directly.
✅ Confirmed NOT Exposed
McGraw Hill has stated that passwords, payment-card numbers, coursework, grades, and FERPA-protected student records were not stored in the affected Salesforce object.
Company Response
What McGraw Hill Did
“We have completed a thorough review with external forensic experts and notified the relevant authorities. We are taking additional steps to harden our cloud configuration to prevent any recurrence.”
Actions Taken by McGraw Hill
- Locked down the misconfigured Salesforce object and audited all sharing rules across the instance
- Engaged third-party cyber forensics specialists to confirm the scope of access
- Notified regulators in the US, EU and Australia
- Began emailing affected customers and institutional contacts
- Published guidance on identifying education-themed phishing using the leaked dataset
What Now?
Steps You Can Take After the McGraw Hill Breach
The exposed data is principally email name and institution affiliation. That combination is exactly what attackers need for convincing education-themed phishing: fake “course access expired” emails, fake instructor adoption requests, and fake reseller invoices.
Education Platform Accounts
Your McGraw Hill account details were exposed. Other ed-tech accounts may use the same email.
Secure your McGraw Hill Connect / SmartBook account
~5 minReview other ed-tech accounts
Email and Digital Identity
Your email is the key to your digital identity. Securing it is a sensible first step.
Strengthen email security
~5 minUnderstand your full account exposure
Identity Protection
Email + name + institution affiliation is the ideal toolkit for targeted spear-phishing.
Treat unsolicited "textbook adoption" emails with suspicion
Watch for fake course-access expiry messages
Monitoring and Reporting
Resources for breach response in Australia, the US and the EU.
Report to your jurisdiction's regulator
Consider requesting erasure
Not sure which of your accounts are affected?
In The Event Of discovers your accounts automatically and alerts you in real time when new breaches affect your data.
Are You Still at Risk?
Compound Risk: McGraw Hill Plus Other Data Leaks
The McGraw Hill leak is, by itself, mostly contact data, but attackers combine it with prior leaks to enrich profiles for high-value targets. Researchers, instructors and administrators are typical spear-phishing targets.
Why this matters
If your email also appears in a credential-bearing breach (such as LinkedIn, Adobe, or any of the MOAB compilations), an attacker who knows your educational affiliation from McGraw Hill and your reused password from elsewhere can target your institutional LMS, library, or research-grant accounts with very high confidence.
- LinkedIn (2021)700M records - name, email, phone, employer (career profile)
- Adobe (2013)153M records - email, password hashes (still credential-stuffed)
- MOAB (2024)26B aggregated records - reused credentials at massive scale
- DemandScience (2024)122M records - work emails, employers, job titles
In The Event Of can overlay your breach exposure across multiple datasets and tell you where your compound risk is highest.
Frequently Asked Questions
McGraw Hill Breach FAQ
Sources
- Have I Been Pwned: McGraw Hill Data Breach
- BleepingComputer: "McGraw-Hill confirms data breach following extortion threat"
- The Register: "McGraw Hill linked to 13.5M-record data leak"
- The Record (Recorded Future News): Educational company McGraw Hill says Salesforce misconfiguration led to data leak
- McGraw Hill: Newsroom & Press Releases
- Salesforce: Security best practices for object sharing
- OAIC: Notifiable Data Breaches Scheme (Australia)
- OAIC: What is personal information? (Privacy Act 1988 categories)
- OAIC: Australian Privacy Principles
Other Major Australian Data Breaches
Data from multiple breaches can be combined to increase identity fraud risk. Review these guides to understand your full exposure.
NYC Health + Hospitals Data Breach 2026
~1.8M records exposed
Australian Courts Data Breach 2026
Thousands of files records exposed
youX Data Breach 2026
~444K records exposed
Prosura Data Breach 2026
300K-500K records exposed
Canvas (Instructure) Data Breach 2026
~275M (claimed) records exposed
Booking.com Data Breach 2026
Undisclosed records exposed
Crunchyroll Data Breach 2026
Undisclosed records exposed
Eurail Data Breach 2026
300K+ records exposed
Basic-Fit Data Breach 2026
1M records exposed
Under Armour Data Breach 2025
72M records exposed
Salesforce (ShinyHunters) Data Breach 2025
~1B records exposed
Allianz Life Data Breach 2025
2.8M records exposed
Workday Data Breach 2025
Undisclosed records exposed
Western Sydney University Data Breach 2025
10K records exposed
Genea Fertility Data Breach 2025
940K records exposed
DeepSeek Data Breach 2025
1M records exposed
Tangerine Telecom Data Breach 2024
232K records exposed
Australian Clinical Labs Data Breach 2022
223K records exposed
Qantas Data Breach 2025
5.7M records exposed
Optus Data Breach 2022
9.8M records exposed
Medibank Data Breach 2022
9.7M records exposed
Latitude Financial Data Breach 2023
14M records exposed
MyDeal (Woolworths) Data Breach 2022
2.2M records exposed
Disclaimer: This guide is provided for general informational purposes only and does not constitute legal, financial, or professional advice. The information is based on publicly available sources at the time of writing and may not reflect the most current developments. In The Event Of Pty Ltd (ABN 38 687 352 647) is not affiliated with McGraw Hill LLC. If you believe you have been affected by this data breach, we recommend contacting the relevant authorities and seeking professional guidance specific to your circumstances.