McGraw Hill Data Breach (2026): What Was Exposed & What To Do

In April 2026, education company McGraw Hill confirmed a data breach that followed an extortion attempt. The company attributed the exposure to a Salesforce misconfiguration and stated that a limited set of data from a webpage hosted on the Salesforce platform had been accessed. More than 100 GB of data containing 13.5 million unique email addresses was later distributed publicly, with names, physical addresses, and phone numbers appearing in some records.

The incident is notable because it involves a large volume of contact information from an organization that serves students, educators, and institutions. Public distribution of the material increases the chance that the data will be used for further contact-based activity.

Breaking down the breach

McGraw Hill reported the incident on April 10, 2026. The company described the event as resulting from a Salesforce misconfiguration that exposed data from a webpage hosted on that platform. It characterized the exposed material as a limited set.

After the initial report, more than 100 GB of data was placed in public circulation. The distributed files included 13.5 million unique email addresses. Names, physical addresses, and phone numbers appeared in some records but not consistently across all entries.

How a breach like this happens

Incidents involving cloud-hosted web pages often begin with configuration settings that allow unintended access. A misconfigured permission or sharing rule can make content reachable without authentication.

Once data is accessible, threat actors may discover it through automated scanning or manual review. In some cases an extortion demand follows discovery. If the demand is not met, the material may be copied and released publicly, increasing its availability to others.

Who is McGraw Hill?

McGraw Hill is an education company that provides textbooks, digital learning platforms, and assessment tools to schools, universities, and individual learners. Organizations in this sector routinely collect contact details to manage accounts, deliver course materials, and communicate with users.

A breach at such a company is consequential because the data often belongs to minors or young adults and is tied to educational records. Contact information from this sector can be used to reach large numbers of individuals who may not frequently monitor their online accounts.

What was likely exposed

The company and subsequent public distribution identified email addresses, names, phone numbers, and physical addresses as present in the material. The presence of names, addresses, and phone numbers was inconsistent across records.

Exact contents beyond these fields remain unconfirmed in public statements. Organizations of this type commonly hold additional information such as usernames, course enrollment details, or institutional affiliations, but no confirmation exists that such fields were included in the distributed data.

Why it matters

Exposure of email addresses and phone numbers raises the likelihood of increased unsolicited contact and phishing attempts directed at the affected individuals. Physical addresses add a layer of location information that can be combined with other sources.

For the organization, the incident highlights risks associated with third-party hosting platforms and the difficulty of containing data once it has been copied. Educational institutions hold information about large populations over extended periods, which can extend the window during which exposed records remain relevant.

If your data was in this breach

Individuals can begin by monitoring their email accounts for unusual login attempts and enabling multi-factor authentication where available. Reviewing privacy settings on any McGraw Hill–related accounts and watching for unsolicited messages that reference personal details can help limit follow-on activity.

Readers may also run a free exposure scan of their email address against known breach data sets to determine whether their information appears in this or other publicly discussed incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.