McGraw Hill Data Breach 2026: 13.5 Million Records, a Misconfigured Salesforce Page, and the EdTech Pattern

In April 2026, the 117-year-old education publisher McGraw Hill became the latest name on the ShinyHunters leak site, after the group published more than 100 gigabytes of data tied to 13.5 million accounts. The cause was not a sophisticated intrusion. It was a misconfigured webpage hosted in McGraw Hill's Salesforce environment, left accessible without proper authentication. The company described the exposure as a limited set of data from a webpage hosted by Salesforce on its platform. The data, names, physical addresses, phone numbers, and email addresses for millions of students, educators, and customers, was anything but limited once it was posted publicly.

ShinyHunters listed McGraw Hill on its dark-web extortion portal in April 2026, claiming roughly 45 million Salesforce records and threatening to publish unless paid by April 14. McGraw Hill confirmed the incident to BleepingComputer, stating that attackers had exploited a misconfiguration in its Salesforce environment and that the exposure was limited to a webpage hosted on the platform, not its core systems, courseware, or customer databases.

When the extortion attempt did not produce a payment, the group released over 100 GB of data. Have I Been Pwned analysis confirmed 13.5 million unique email addresses across the leaked files, with names, phone numbers, and physical addresses appearing inconsistently across records. Roughly 47 percent of the email addresses had appeared in prior breaches, but a substantial share were newly exposed. No passwords or financial data were included. Salesforce stated there was no indication its platform had been compromised and that the event was not tied to any known vulnerability in its technology, pointing instead to customer-side misconfiguration.

This breach is a study in how cloud misconfiguration becomes mass exposure. A Salesforce-hosted webpage, intended to serve some subset of data, was configured to allow access without proper authentication controls. To an attacker, that is not a hack so much as an open door: the data was reachable by anyone who found the page. ShinyHunters has industrialized the discovery of exactly these misconfigurations across organizations that rely on Salesforce, which is why the same root cause has surfaced at multiple companies in the same window.

The contrast with a classic intrusion matters for how executives think about defense. There was no malware, no credential theft, no lateral movement to detect. The control that would have prevented this is mundane: correct access configuration on a public-facing cloud asset, verified by routine review. See our explainer on the supply chain attack and the discipline of the security audit.

For sponsors with EdTech, SaaS, or any customer-facing cloud business in the portfolio, McGraw Hill is a cheap lesson in an expensive risk. The breach required no advanced tradecraft; it required a single misconfigured public asset. That means the exposure is everywhere a portfolio company has shipped cloud-hosted pages quickly, which is to say nearly everywhere.

Diligence and hold-period monitoring should include external attack-surface review: what public cloud assets does the company expose, and are any of them serving data without authentication? It is one of the fastest, cheapest checks available and it maps directly to the way these breaches actually happen. See cyber due diligence.