According to BleepingComputer, ShinyHunters leaked data from 13.5 million McGraw Hill user accounts, and McGraw Hill said it identified unauthorized access to a limited set of data from a Salesforce-hosted webpage on its platform [2]. According to The Register, HIBP says the leak exposed names, phone numbers, email addresses and some physical addresses [1]. Bocconi University advises McGraw Hill users to stay alert for suspicious emails, unexpected messages or unusual requests for personal information, and to update passwords, especially reused ones [3].
Education publisher McGraw Hill data leaked via Salesforce-hosted page, about 13.5 million accounts exposed
1 min read
- Disclosed
- Apr 14, 2026
- Published
- Nov 11, 2026
- Last updated
- Nov 11, 2026
- Scale
- 13,500,000 accounts[1]
- CVSS basis
- Our assessment
- Technology
- Attack vector
- Impact
- Data type
- Actor type
- Motivation
On this page
30-second summary
Timeline
Technical details
Remediation
Vendor guidance
- 1Change passwords mitigate[3]
Change your McGraw Hill password and any reused passwords.
References
Official / primary1
- [3]Bocconi University2026-04-17Accessed 2026-11-11Snapshot 2026-11-11 sha256 60cd28157a89
“If you have used McGraw Hill services, you are advised to remain alert for suspicious emails, unexpected messages, or unusual requests for personal information.”
Media2
- [1]
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.