ShinyHunters Claims Udemy Data Breach Exposing 1.4M User Records

Key Takeaways

• The ShinyHunters cybercrime group claims to have breached Udemy, a major online learning platform.
• Over 1.4 million user records, including personally identifiable information (PII) and internal corporate data, are reportedly compromised.
• ShinyHunters issued a “Pay or Leak” ultimatum, threatening to release data if Udemy does not comply by April 27, 2026.
• Udemy has not yet publicly confirmed or denied the alleged breach.

Notorious Cybercrime Group Claims Udemy Breach

ShinyHunters, a prominent cybercriminal organization, has asserted responsibility for a data breach affecting Udemy, Inc., a leading global platform for online education. The group alleges it has obtained more than 1.4 million records, which purportedly contain both personally identifiable information (PII) and internal corporate data.

The first indication of this alleged compromise surfaced on April 24, 2026. On that date, ShinyHunters posted a “Pay or Leak” ultimatum on their dedicated data leak site. The message established a firm deadline of April 27, 2026, for Udemy to respond before the stolen data would be publicly released.

The threat message explicitly warned, “Make the right decision, don’t be the next headline.” This tactic is characteristic of ShinyHunters’ established method of operation, which consistently involves extortion attempts.

Understanding ShinyHunters’ Operations

ShinyHunters is a financially motivated, black-hat extortion group believed to have emerged in 2019. They have cultivated a well-documented reputation for their “Pay or Leak” strategy, which involves exfiltrating sensitive data, threatening victims, and then either selling the information or publicly releasing it if ransom demands are not met.

The group first garnered significant attention in 2020 after claiming to have stolen over 200 million records from more than a dozen companies.

In 2026 alone, ShinyHunters has intensified its focus on SaaS platforms and the education sector. Previous targets this year include Vercel and McGraw-Hill. Notably, in February, Harvard University was also impacted, leading to the exposure of approximately 115,000 sensitive alumni records.

Google Threat Intelligence actively monitors the group’s expanding data theft operations targeting SaaS providers, attributing their extortion activities to an affiliated cluster identified as UNC6240.

In recent years, ShinyHunters has shifted its tactics from traditional network exploitation to prioritize social engineering and identity-layer attacks. These include vishing (voice phishing), multi-factor authentication (MFA) bypass techniques, and credential harvesting through information stealer malware.

Their campaigns frequently exploit compromised SaaS platforms, third-party integrations, and stolen contractor credentials to circumvent perimeter defenses. This approach was evident in the Vercel breach, where a third-party vendor named Context.ai served as the initial point of entry.

The education sector remains a particularly attractive target for ShinyHunters. The group previously breached India’s Unacademy platform, resulting in the theft of over 10 million user accounts.

As of the time of this report, Udemy has not released an official statement to confirm or deny the alleged breach. The incident is currently undergoing verification, and cybersecurity researchers are closely monitoring ShinyHunters’ leak site for any data publication following the April 27, 2026, deadline.

What You Should Do

• Organizations utilizing Udemy for employee training should monitor for any unusual or suspicious network activity.
• All active Udemy account holders are advised to proactively reset their passwords.
• Enable multi-factor authentication (MFA) on your Udemy account and any other online services as a critical precautionary security measure.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.