Udemy udemy.com Udemy data breach: what happened and what to do
In April 2026 Udemy was hit by an extortion attempt and the stolen data was then leaked. Have I Been Pwned lists 1,401,259 emails of customers and instructors, with names, addresses, phone numbers, employers and instructor payout methods.
View all 13,115 breaches- Breach date
- 24 Apr 2026
- Made public
- 26 Apr 2026
- Affected
- 1,401,259
- Data exposed
- Email addresses, Employers, Job titles, Names, Payment methods, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Udemy is an online course marketplace, and its April 2026 breach hit both people who take courses and the instructors who sell them. The instructor data is the more sensitive part.
What happened
According to Have I Been Pwned, Udemy was the victim of a "pay or leak" extortion attempt in April 2026. That's where attackers steal data, demand payment, and publish it if the company doesn't pay. The breach is dated 24 April 2026, and the data was subsequently leaked publicly. Have I Been Pwned added it two days later, on 26 April.
The leaked data held 1,401,259 unique email addresses, belonging to customers and to instructors. Cybernews reported on the attackers' claim of the theft before the leak.
What was exposed
Every record had an email address. Many also carried a name, a physical address, a phone number and employer information. For instructors, the data included payout methods: PayPal, cheque and bank transfer.
Have I Been Pwned doesn't list passwords in the exposed data. It lists payout methods as a data type, so it's reasonable to read that as the type of payout chosen rather than full account numbers, but check any notice you get from Udemy for specifics.
What can criminals do with that? Course buyers get phishing emails that cite a real course or employer. Instructors are a better target for fraud. Someone who knows you're paid through PayPal, by cheque or by bank transfer can write a believable message about a payout problem and ask you to log in or confirm details. The employer field also helps with workplace scams, such as a fake message from your company's IT team.
What Udemy did
The extortion attempt and the leak are reported by Have I Been Pwned and Cybernews. If Udemy emailed you, keep that notice, because it lists what was taken for your account.
What to do about it
There's no password to reset from this breach alone. The practical risk is targeted phishing and fraud aimed at your payout details. If you teach on Udemy, treat any message about a payout, a tax form or an account problem as suspect until you've checked it by logging in directly. Don't click through from email.
Changing your Udemy password is still sensible housekeeping, particularly if you reused it.
Why extortion breaches spread
In a pay or leak attack, the data is already stolen before anyone is asked for money. Paying the attackers doesn't undo that, and it doesn't stop copies circulating. Once the data is public, treat it as permanent. What you control is how much it can be used against you: unique passwords, two-factor authentication and caution with anything that cites your payout details or employer.
What to do if you were in it
- 1
Be suspicious of payout and account messages
If you teach on Udemy, don't act on emails about payouts, tax forms or suspended accounts. Log in by typing the address yourself and check there.
- 2
Watch for phishing that mentions courses or your employer
Names, employers and phone numbers were exposed, so scammers can make messages sound specific. Verify before you click or reply.
- 3
Check your PayPal and bank activity
If you receive payouts, watch the account they go to for changes you didn't make, and tell the provider about anything odd.
- 4
Change your Udemy password and turn on 2FA
Use a unique password, and add two-factor authentication on Udemy and on your email.
- 5
Check which breaches include your email
Run a free Serus scan to see whether your email or phone number appears in this and other breaches.
Frequently asked
Was I affected by the Udemy breach?
If you were a Udemy customer or instructor in April 2026, possibly. Have I Been Pwned lists 1,401,259 email addresses, and you can search yours there or run a free Serus scan.
What was exposed in the Udemy breach?
Email addresses, names, physical addresses, phone numbers and employer information, plus instructor payout methods including PayPal, cheque and bank transfer.
Were passwords exposed?
Have I Been Pwned doesn't list passwords for this breach. Change your Udemy password anyway if you reused it elsewhere.
Is there a settlement?
No source reviewed for this page mentions one. Check Udemy's notice for updates.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
