Salesforce misconfiguration leads to non-sensitive data exposure at McGraw-Hill amid ShinyHunters extortion claims
Summary
Hide ▲
Show ▼
McGraw-Hill confirmed a data breach affecting 13.5 million user accounts after ShinyHunters exploited a Salesforce environment misconfiguration to steal and leak non-sensitive data, including names, addresses, phone numbers, and email addresses. The company stated the breach did not impact its core Salesforce accounts, customer databases, courseware, or internal systems, though ShinyHunters claimed possession of 45 million records with PII. The affected webpages were secured promptly, and McGraw-Hill is collaborating with Salesforce to remediate the issue. Have I Been Pwned verified the leak of over 100GB of data tied to 13.5 million accounts. The incident remains distinct from a separate, unverified claim by a threat actor posing as ShinyHunters, who alleges breaching Vercel and selling stolen data, including API keys and employee records. Vercel has disclosed the incident and is investigating with law enforcement and incident response experts, while denying any impact to services.
Timeline
-
14.04.2026 21:07 2 articles · 5d ago
McGraw-Hill discloses Salesforce misconfiguration-driven data exposure amid ShinyHunters extortion claim
McGraw-Hill confirmed the unauthorized access to its Salesforce-hosted data was exploited by ShinyHunters, who subsequently leaked data from 13.5 million user accounts, including names, physical addresses, phone numbers, and email addresses. The company reiterated that the breach did not impact core systems but acknowledged the broader Salesforce misconfiguration affecting multiple organizations. Have I Been Pwned verified the leak of over 100GB of compromised data.
Show sources
- McGraw-Hill confirms data breach following extortion threat — www.bleepingcomputer.com — 14.04.2026 21:07
- Data breach at edtech giant McGraw Hill affects 13.5 million accounts — www.bleepingcomputer.com — 16.04.2026 13:35
Information Snippets
-
A Salesforce environment misconfiguration allowed unauthorized access to a limited set of McGraw-Hill data hosted on a Salesforce webpage, as confirmed by the company.
First reported: 14.04.2026 21:071 source, 2 articlesShow sources
- McGraw-Hill confirms data breach following extortion threat — www.bleepingcomputer.com — 14.04.2026 21:07
- Data breach at edtech giant McGraw Hill affects 13.5 million accounts — www.bleepingcomputer.com — 16.04.2026 13:35
-
McGraw-Hill asserts the breach did not impact its Salesforce accounts, customer databases, courseware, internal systems, or expose sensitive data such as Social Security numbers, financial account information, or student data.
First reported: 14.04.2026 21:071 source, 2 articlesShow sources
- McGraw-Hill confirms data breach following extortion threat — www.bleepingcomputer.com — 14.04.2026 21:07
- Data breach at edtech giant McGraw Hill affects 13.5 million accounts — www.bleepingcomputer.com — 16.04.2026 13:35
-
ShinyHunters claimed responsibility for the incident, alleging possession of 45 million Salesforce records containing personally identifiable information (PII), which contrasts with McGraw-Hill’s statement.
First reported: 14.04.2026 21:071 source, 2 articlesShow sources
- McGraw-Hill confirms data breach following extortion threat — www.bleepingcomputer.com — 14.04.2026 21:07
- Data breach at edtech giant McGraw Hill affects 13.5 million accounts — www.bleepingcomputer.com — 16.04.2026 13:35
-
McGraw-Hill reported that the affected webpages were secured immediately after detecting the unauthorized activity and is working with Salesforce to strengthen protections.
First reported: 14.04.2026 21:071 source, 2 articlesShow sources
- McGraw-Hill confirms data breach following extortion threat — www.bleepingcomputer.com — 14.04.2026 21:07
- Data breach at edtech giant McGraw Hill affects 13.5 million accounts — www.bleepingcomputer.com — 16.04.2026 13:35
-
ShinyHunters is a known data extortion group with multiple high-profile breaches in 2025 and 2026, including attacks on Rockstar Games, Hims & Hers, the European Commission, Telus Digital, Wynn Resorts, Canada Goose, Match Group, Panera Bread, and CarGurus.
First reported: 14.04.2026 21:071 source, 1 articleShow sources
- McGraw-Hill confirms data breach following extortion threat — www.bleepingcomputer.com — 14.04.2026 21:07
-
ShinyHunters leaked data from 13.5 million McGraw Hill user accounts after breaching the company's Salesforce environment.
First reported: 16.04.2026 13:351 source, 1 articleShow sources
- Data breach at edtech giant McGraw Hill affects 13.5 million accounts — www.bleepingcomputer.com — 16.04.2026 13:35
-
The leaked data includes names, physical addresses, phone numbers, and email addresses, which could be used for spear-phishing attacks.
First reported: 16.04.2026 13:351 source, 1 articleShow sources
- Data breach at edtech giant McGraw Hill affects 13.5 million accounts — www.bleepingcomputer.com — 16.04.2026 13:35
-
Have I Been Pwned confirmed the leak of over 100GB of files containing data linked to 13.5 million accounts.
First reported: 16.04.2026 13:351 source, 1 articleShow sources
- Data breach at edtech giant McGraw Hill affects 13.5 million accounts — www.bleepingcomputer.com — 16.04.2026 13:35
-
McGraw Hill confirmed ShinyHunters' breach claims in a statement, attributing the incident to a Salesforce environment misconfiguration.
First reported: 16.04.2026 13:351 source, 1 articleShow sources
- Data breach at edtech giant McGraw Hill affects 13.5 million accounts — www.bleepingcomputer.com — 16.04.2026 13:35
-
The exposed data is part of a broader issue involving a Salesforce environment misconfiguration impacting multiple organizations.
First reported: 16.04.2026 13:351 source, 1 articleShow sources
- Data breach at edtech giant McGraw Hill affects 13.5 million accounts — www.bleepingcomputer.com — 16.04.2026 13:35
-
Vercel, a cloud development platform known for Next.js, disclosed a security incident involving unauthorized access to internal systems affecting a limited subset of customers.
First reported: 19.04.2026 20:321 source, 1 articleShow sources
- Vercel confirms breach as hackers claim to be selling stolen data — www.bleepingcomputer.com — 19.04.2026 20:32
-
The incident was disclosed in a security bulletin where Vercel warned customers to review environment variables, use sensitive environment variable features, and rotate secrets if needed.
First reported: 19.04.2026 20:321 source, 1 articleShow sources
- Vercel confirms breach as hackers claim to be selling stolen data — www.bleepingcomputer.com — 19.04.2026 20:32
-
A threat actor claiming to be ShinyHunters posted on a hacking forum alleging breach of Vercel, offering to sell access keys, source code, database data, internal deployments, and API keys, including NPM and GitHub tokens.
First reported: 19.04.2026 20:321 source, 1 articleShow sources
- Vercel confirms breach as hackers claim to be selling stolen data — www.bleepingcomputer.com — 19.04.2026 20:32
-
The attacker shared a text file with 580 records of Vercel employee data, including names, email addresses, account status, and activity timestamps, as well as a screenshot of an internal Vercel Enterprise dashboard.
First reported: 19.04.2026 20:321 source, 1 articleShow sources
- Vercel confirms breach as hackers claim to be selling stolen data — www.bleepingcomputer.com — 19.04.2026 20:32
-
Vercel stated it is investigating the incident, engaged incident response experts, notified law enforcement, and is working with impacted customers while assuring services remain unaffected.
First reported: 19.04.2026 20:321 source, 1 articleShow sources
- Vercel confirms breach as hackers claim to be selling stolen data — www.bleepingcomputer.com — 19.04.2026 20:32
-
Threat actors linked to the ShinyHunters extortion gang denied involvement in the Vercel incident when contacted by BleepingComputer.
First reported: 19.04.2026 20:321 source, 1 articleShow sources
- Vercel confirms breach as hackers claim to be selling stolen data — www.bleepingcomputer.com — 19.04.2026 20:32
Similar Happenings
Rockstar Games analytics data exfiltrated via third-party Snowflake compromise linked to Anodot breach
The extortion group ShinyHunters leaked approximately 78.6 million records of Rockstar Games’ internal analytics data, asserting the data was exfiltrated from Snowflake environments using authentication tokens stolen during a recent breach at Anodot, a data anomaly detection provider. The compromised datasets reportedly include in-game revenue metrics, player behavior tracking, and game economy data for Grand Theft Auto Online and Red Dead Online, as well as customer support analytics from Zendesk. Rockstar Games acknowledged a limited, non-material data breach tied to the third-party incident, stating no impact on its operations or players.
CarGurus data breach exposes 12.4 million records
The ShinyHunters extortion group has leaked personal information from 12.4 million CarGurus accounts. The data includes email addresses, phone numbers, physical addresses, and financial application details. CarGurus has not confirmed the breach, but HaveIBeenPwned (HIBP) has verified the dataset, noting that 3.7 million records are new. The leaked data could be used for phishing attacks. CarGurus is a U.S.-based digital auto platform with an estimated 40 million monthly visitors. The breach follows a pattern of similar attacks by ShinyHunters, who often use social engineering to gain access to SaaS platforms like Salesforce and Microsoft 365.
Optimizely Data Breach After Vishing Attack
An ongoing wave of vishing-led breaches attributed to ShinyHunters has claimed a new victim: Aura, a digital safety firm. The attack exposed contact details of nearly 900,000 individuals, stemming from a marketing tool inherited in a 2021 acquisition. ShinyHunters claimed the theft of 12GB of files containing PII and corporate data, releasing it after failed extortion attempts. The company emphasized no SSNs, passwords, or financial data were compromised and is conducting an internal review with law enforcement involvement. Earlier in February, Optimizely disclosed a similar breach following a voice phishing attack that compromised basic business contact information. Both incidents underscore the continued exploitation of vishing tactics by ShinyHunters to gain initial access to organizations, with impacts focused on contact data rather than deeper system compromise.
Figure Fintech Breach Exposes 967,200 Accounts via Social Engineering
Figure Technology Solutions, a blockchain-based fintech firm, suffered a data breach affecting nearly 1 million accounts. Hackers stole personal and contact information through a social engineering attack. The breach was attributed to the ShinyHunters extortion group, which leaked 2.5GB of data from loan applicants. The attackers impersonated IT support to trick employees into providing access to SSO accounts, gaining entry to various enterprise applications.
Discord User Data Compromised in Third-Party Breach
Hackers claim to have stolen data from 5.5 million unique Discord users after compromising a third-party customer service provider. The attack occurred on September 20, 2025, affecting users who interacted with Discord’s customer support and/or Trust and Safety teams. The breach appears to be financially motivated, with hackers demanding a ransom. The Scattered Lapsus$ Hunters (SLH) threat group claimed responsibility for the attack, stating they breached a Zendesk instance used by Discord for customer support. The compromised data includes real names, usernames, email addresses, contact details, IP addresses, messages, attachments, photos of government-issued identification documents, partial billing information, and purchase history. Discord took immediate action to isolate the support provider from its ticketing system and launched an investigation with the help of a forensics firm and law enforcement. The hackers also accessed corporate data, including training materials and internal presentations. Discord has notified law enforcement and relevant data protection authorities about the incident. No full credit card numbers, CVV codes, passwords, or authentication data were compromised. Additionally, no messages or activity on Discord outside of communication with customer support were obtained by the attackers.