McGraw Hill Data Breach Exposes 13.5 Million Users’ Personal Information

Key Takeaways

• Educational publisher McGraw Hill confirmed a data breach affecting 13.5 million users.
• The incident resulted from a misconfiguration within the company’s Salesforce environment.
• Over 100GB of personal data, including email addresses, names, phone numbers, and physical addresses, has been publicly distributed online following a failed extortion attempt.
• Users are advised to remain vigilant against phishing and targeted social engineering attacks.

McGraw Hill Confirms Major Data Breach Affecting 13.5 Million Users

Education publishing giant McGraw Hill has officially confirmed a significant data breach, impacting approximately 13.5 million users. The breach, which came to light in April 2026, has led to over 100GB of stolen personal information being publicly disseminated online after an unsuccessful extortion attempt against the company.

The root cause of the compromise has been identified as a misconfiguration within McGraw-Hill’s Salesforce environment. While the company initially described the exposure as a “limited set of data from a webpage hosted by Salesforce,” the sheer volume and scope of the leaked information suggest a more extensive compromise than initially portrayed.

Details of the Compromised Data

Following the failure of their extortion efforts, the threat actors released the complete dataset to the public. Analysis by Have I Been Pwned revealed 13.5 million unique email addresses among the dumped files. In addition to email addresses, other personal data fields such as full names, phone numbers, and physical addresses were found, though their presence varied across different records within the dataset.

The exposed data includes:

• Email addresses (13.5 million unique entries)
• Full names
• Phone numbers
• Physical addresses

The inconsistency in data completeness across records suggests that the breach may have aggregated information from multiple data sources or that user profiles had varying levels of detail within the compromised system.

This incident highlights a growing concern in enterprise cybersecurity: misconfigurations within cloud platforms like Salesforce. Such errors can inadvertently expose sensitive user data by failing to implement proper authentication controls, a critical oversight, especially for an organization managing millions of student and educator records globally.

Given McGraw Hill’s extensive reach within academic institutions and its global user base, the exposure of this personal data carries substantial risks. Affected individuals could become targets for sophisticated phishing campaigns, targeted social engineering attacks, and increased spam leveraging their leaked contact information.

McGraw Hill’s Response and User Guidance

McGraw Hill has acknowledged the breach, attributing it to the Salesforce misconfiguration. Despite the company’s characterization of the exposed data as “limited,” the public release of over 100GB of data affecting 13.5 million individuals points to a significant security incident that extends beyond a minor configuration flaw.

What You Should Do

Users who believe they may be affected by the McGraw Hill data breach are strongly advised to take the following preventative measures:

• Exercise extreme caution regarding unsolicited emails, particularly those purporting to be from McGraw Hill or affiliated educational institutions, as these may be phishing attempts.
• Be vigilant for any unexpected phone calls or messages that reference personal details, as these could be social engineering attempts.
• Update passwords for their McGraw Hill accounts and any other online services where they may have reused the same credentials.
• Utilize breach monitoring services to track suspicious activity associated with their email addresses and other personal information.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.