McGraw Hill Confirms Data Breach Exposing 13.5 Million Users’ Personal Data

McGraw-Hill confirmed an April 2026 data breach resulting from a misconfigured Salesforce-hosted webpage that exposed a dataset exceeding 100GB and approximately 13.5 million unique email addresses; additional PII such as names, phone numbers, and physical addresses appeared inconsistently across records. After an unsuccessful extortion attempt the attackers publicly released the stolen files, creating significant risk of phishing, targeted social engineering, spam, and reputational and legal consequences for the company and affected individuals.