McGraw Hill data breach
Was I affected?
McGraw Hill confirmed a breach affecting about 13.5 million email addresses, exposing names, email addresses, phone numbers and addresses. You may be affected if you created an account, bought materials or contacted McGraw Hill (students, instructors and customers); check your email on Have I Been Pwned.
| Announced | Apr 14, 2026 |
|---|---|
| When it happened | Early 2026 |
| Email addresses exposed | 13.5 million |
| Data exposed | Names, Email addresses, Phone numbers and Addresses |
| Through a vendor | Salesforce |
| Status | Confirmed by the company or a regulator filing |
What happened
Education publisher McGraw Hill confirmed in April 2026 that a limited set of data was taken from a webpage hosted on its Salesforce platform, blaming a wider Salesforce configuration issue, after ShinyHunters threatened to leak it. More than 100 GB was then published containing about 13.5 million unique emails, with names, addresses and phone numbers in some records. McGraw Hill said no SSNs, financial account data or student data from its learning platforms were involved.
What should I do?
- Treat emails, texts and calls that mention McGraw Hill, Connect or textbook orders as suspect; don't click links or share codes, and contact the company through its official app or website.
- Change your McGraw Hill password and any other account that uses the same password, and turn on two-step verification.
- Ignore requests to 'verify' student or instructor accounts that arrive by email or text.
Check whether your email address is in this breach on Have I Been Pwned (breach data from haveibeenpwned.com, CC BY 4.0).
Check the other services you use →
Sources
- McGraw-Hill confirms data breach following extortion threat · BleepingComputer (news)
- Data breach at edtech giant McGraw Hill affects 13.5 million accounts · BleepingComputer (news)
- McGraw Hill data breach incident exposed 13.5 million accounts · CyberInsider (news)