Back Therecord.Media

Educational company McGraw Hill says Salesforce misconfiguration led to data leak

Therecord.Media • April 15, 2026

The data breach emerged this weekend when the ShinyHunters cybercriminal organization claimed to have stolen 45 million Salesforce records and threatened to leak the information by April 14 if a ransom was not paid.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Data Breach at McGraw Hill Exposes 13.5 Million User Accounts In April 2026, McGraw Hill confirmed a data breach affecting approximately 13.5 million user accounts, attributed to a misconfiguration in its Salesforce environment. The ShinyHunters extortion group claimed responsibility, threatening to leak data unless a ransom was paid. The breach exposed over 100GB of data, including names, email addresses, phone numbers, and some physical addresses. McGraw Hill stated that the incident did not compromise sensitive data such as Social Security numbers or financial information. The company is collaborating with cybersecurity experts and Salesforce to address the issue. Despite assurances, the breach has raised concerns about the security of user data. The incident is part of a broader trend of attacks targeting organizations using Salesforce. The ShinyHunters group has previously breached other high-profile entities, indicating a pattern of targeting educational and corporate systems. 9 sources 65

Extracted Entities

Educational company McGraw Hill says Salesforce misconfiguration led to data leak

The full story

Extracted Entities

Attack Types (1)

Companies (2)

MITRE ATT&CK (1)