McGraw Hill mheducation.com McGraw Hill data breach: what happened and what to do
In April 2026, data from a McGraw Hill cloud misconfiguration was leaked. Have I Been Pwned lists 13,500,136 accounts with email addresses, names, phone numbers and some physical addresses. McGraw Hill said no sensitive data like SSNs or financial details was involved.
View all 13,115 breaches- Breach date
- 10 Apr 2026
- Affected
- 13,500,136
- Data exposed
- Email addresses, Names, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
McGraw Hill publishes textbooks and runs online learning platforms used by students from school to college. In April 2026, data tied to the company was published online after an extortion attempt. Have I Been Pwned (HIBP) added 13,500,136 accounts on 16 April 2026.
What happened
HIBP dates the breach to 10 April 2026. BleepingComputer reported that an extortion group took the data after breaching the company's Salesforce environment earlier that month and then leaked it when negotiations apparently failed. More than 100 GB of data was reportedly published.
McGraw Hill said the attackers exploited a misconfiguration, and that the incident did not affect its Salesforce accounts or its courseware. Nor did it reach customer databases or internal systems. In plain terms, a setting in a cloud customer-management tool was left too open. Anyone who found it could read the data. The company has not published its own count of affected people. The 13.5 million figure comes from HIBP's analysis of the leaked files.
What was exposed
HIBP lists four data types: email addresses, names, phone numbers and physical addresses. HIBP says every record has an email address, while the other fields show up inconsistently across files. Summaries of the company's statement say Social Security numbers and financial information were not compromised.
What that lets criminals do
Students and parents are a natural target. A scammer who knows that your email is tied to McGraw Hill can write messages about textbook orders or course access codes, and those subjects feel routine. Some pose as a refund. Expect texts that claim a code has expired.
Names and phone numbers allow direct calls and texts (vishing and smishing). Some claim to be from a school.
Where a physical address is present, it can be matched against other leaked data to build a fuller profile for fraud. A profile with your name and address is a starting point for identity theft, even without a Social Security number.
Many users here are teenagers and young adults with little credit history. That makes a credit freeze worth considering, because a clean file is what identity thieves like to open accounts against.
The company's response
McGraw Hill said the incident came from a misconfiguration and that its core platforms were not affected. It has not published a full public account of the numbers. For updates, check McGraw Hill's own notices.
What to keep in mind
The data cannot be recalled once it is public, and it keeps circulating. Parents should check which email addresses their children used for school accounts, since those are the ones that appear in leaks like this. The practical work is on your side: a unique password and a skeptical eye on messages, plus a credit freeze for anyone in the household who has never had credit.
What to do if you were in it
- 1
Expect fake messages about courses and access codes
Treat any message about an access code or an account lock with suspicion. Open the McGraw Hill site by typing the address yourself.
- 2
Change your McGraw Hill password and anywhere you reused it
HIBP does not list passwords for this breach. Use a unique password and turn on two-factor authentication where it is offered.
- 3
Consider a credit freeze, including for students
A free freeze at Equifax, Experian and TransUnion blocks new accounts in a name. Young adults can freeze too, and parents can freeze a child's file.
- 4
Treat calls and texts that use your name with care
A caller who knows your name and phone number is not proof of anything. Hang up and call the school or company back using a number you look up yourself.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan at serus.ai to see which breaches include your email address or phone number. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you hear about the next one early. It can't remove data from breach dumps, which is why the other steps here matter.
Frequently asked
Was I affected by the McGraw Hill data breach?
HIBP lists 13,500,136 accounts. Search your email on Have I Been Pwned or run a free Serus scan.
What was exposed in the McGraw Hill breach?
Email addresses for every record, and names, phones or addresses in many of them.
Were Social Security numbers exposed?
Summaries of McGraw Hill's statement say no Social Security numbers or financial information were compromised.
Should I change my password?
HIBP does not list passwords here, but change yours if you reused it. Phishing is the more likely problem.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
