McGraw Hill data breach: 13.5M accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2026-04-16
In April 2026, education company McGraw Hill confirmed a data breach following an extortion attempt. Attributed to a Salesforce misconfiguration, the company stated the incident exposed "a limited set of data from a webpage hosted by Salesforce on its platform". More than 100GB of data was later publicly distributed, containing 13.5M unique email addresses across multiple files, with additional fields such as name, physical address and phone number appearing inconsistently across some records. Exposed data: email addresses, names, phone numbers, physical addresses. The breach dates from Apr 10, 2026; Have I Been Pwned loaded it on Apr 16, 2026.
What to do
- If you had a McGraw Hill account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
