Scholastic scholastic.com Scholastic data breach: what happened and what to do
In January 2025 data from the publisher Scholastic surfaced. Have I Been Pwned counts 4,247,768 accounts: email addresses, names, phone numbers and physical addresses. Many records include educators.
View all 13,115 breaches- Breach date
- 8 Jan 2025
- Affected
- 4,247,768
- Data exposed
- Email addresses, Names, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Scholastic is the children's book publisher behind school book fairs and classroom clubs. In January 2025 a breach of its data surfaced. Have I Been Pwned (HIBP) dates it to 8 January 2025, added it five days later and counts 4,247,768 unique email addresses.
What happened
HIBP says the breach contained 4.2 million unique email addresses, with many records also including a name, phone number and physical address. Press coverage in January 2025 put the full dataset at about 8 million records, with over a million belonging to educators, and reported that the person claiming responsibility said they'd got in using credentials stolen from an employee by malware. Scholastic said it was investigating the claim. The figures on this page are HIBP's.
News reports also noted that a large share of the email addresses were already in HIBP from earlier breaches.
What was exposed
HIBP lists email addresses, names, phone numbers and physical addresses. Not every record had every field. No passwords or payment details are listed.
Because Scholastic sells to schools, many records belong to teachers and other school staff, so a home or school address and a work email may both be involved. Parents who ordered through a school may be in it too.
What that lets criminals do
Names, emails, phone numbers and addresses are the standard kit for phishing and scam calls. A message about a book order, a school fundraiser or a "problem with your classroom account" matches what recipients really expect, which is why it works.
Teachers are a particular target. Impersonating a school administrator, a district office or a payroll department is a familiar fraud, and a leaked list of educators with school addresses makes it easier to aim.
The physical address matters most for parents and teachers who gave a home address. It lets a stranger connect your name to where you live. A person-search site might already show that, but a leak confirms it.
Parents should note that children's names weren't listed among the data types, only the adult account holder's.
The company's response
According to the reporting, Scholastic said it was investigating. The sources below cover the timeline and what the claimed attacker said.
How to check
Search your email address on HIBP. If you've ordered through a school or taught in one, check your school and personal emails.
Being in the data doesn't mean your Scholastic account was used. It means your contact details were taken and circulated.
Where to start
No passwords are listed, so there's nothing to reset right away. Begin with the messages: be wary of anything about school orders or classroom accounts that asks for money or logins, and confirm it with the school or the official site before you reply.
What to do if you were in it
- 1
Expect phishing that uses your details
Emails, texts and calls that mention your name, employer or phone number are more believable. Don't click links in unexpected messages. Go to the company's site yourself, and treat urgent requests for money or codes as a red flag.
- 2
Verify school and payment messages directly
If a message claims to be from a school, a district or Scholastic and asks for payment or login details, contact the school office or visit the official site yourself.
- 3
Watch for strangers who know your address
If your home address was listed, be careful about unexpected deliveries, letters and callers who seem to know where you live. Consider where else your address is public.
- 4
Change the password if you reuse it
No passwords are listed, but if you used the same password on a Scholastic account and elsewhere, change it and turn on two-factor authentication.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan with Serus. It checks breach databases for your email address and phone number and shows which breaches include you, so you know which passwords and accounts to deal with first.
Frequently asked
Was I affected by the Scholastic breach?
Search your email address on Have I Been Pwned. It lists 4,247,768 accounts for Scholastic.
What was exposed?
Email addresses, names, phone numbers and physical addresses. Not every record had every field.
Were children's details exposed?
HIBP's entry lists adult contact details. It doesn't list children's data types.
Should I change my password?
No passwords are listed. Change it if you reuse it on other sites.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
