McGraw-Hill and Salesforce: McGraw-Hill confirms data breach following extortion threat

McGraw-Hill Confirms Data Breach via Salesforce Misconfiguration, Disputes ShinyHunters’ Claims

Education giant McGraw-Hill has acknowledged a data breach stemming from a misconfigured Salesforce environment, which allowed hackers to access a limited set of internal data. The company stated that the incident did not compromise its Salesforce accounts, customer databases, or core systems, and that the exposed information was non-sensitive, lacking Social Security numbers, financial details, or student data from its platforms.

The breach was first flagged by the extortion group ShinyHunters, which listed McGraw-Hill as a victim on its dark-web portal and threatened to leak allegedly stolen data including 45 million records containing personally identifiable information (PII) by April 14 unless a ransom was paid. McGraw-Hill disputed the group’s claims, asserting that the accessed data was minimal and not critical.

McGraw-Hill, a major provider of textbooks, digital learning tools, and K-12/university platforms with $2.2 billion in annual revenue, confirmed that the affected webpages were secured immediately after detecting the unauthorized access. The company is collaborating with Salesforce to reinforce protections and address the misconfiguration, which it described as part of a broader issue impacting multiple Salesforce clients.

ShinyHunters, known for high-profile breaches in 2024 including attacks on Rockstar Games, Hims & Hers, the European Commission, and Panera Bread has also targeted other education-related entities, such as Infinite Campus, a K-12 student information system provider, in March. The group’s extortion tactics have raised concerns across industries, though McGraw-Hill’s investigation, supported by external cybersecurity experts, maintains that the incident’s impact was contained.

Source: https://www.bleepingcomputer.com/news/security/mcgraw-hill-confirms-data-breach-following-extortion-threat/

McGraw Hill cybersecurity rating report: https://www.rankiteo.com/company/mcgraw-hill-education

Salesforce cybersecurity rating report: https://www.rankiteo.com/company/salesforce

"id": "MCGSAL1776191039",
"linkid": "mcgraw-hill-education, salesforce",
"type": "Breach",
"date": "4/2026",
"severity": "50",
"impact": "2",
"explanation": "Attack limited on finance or reputation"

{'affected_entities': [{'industry': 'Education (Textbooks, Digital Learning '
                                    'Tools, K-12/University Platforms)',
                        'name': 'McGraw-Hill',
                        'size': 'Large ($2.2 billion annual revenue)',
                        'type': 'Corporation'}],
 'attack_vector': 'Misconfigured Salesforce environment',
 'data_breach': {'number_of_records_exposed': 'Disputed (ShinyHunters claimed '
                                              '45 million; McGraw-Hill denied)',
                 'personally_identifiable_information': 'Disputed '
                                                        '(ShinyHunters claimed '
                                                        'PII; McGraw-Hill '
                                                        'denied)',
                 'sensitivity_of_data': 'Low (no SSNs, financial details, or '
                                        'student data)',
                 'type_of_data_compromised': 'Internal data (non-sensitive)'},
 'description': 'Education giant McGraw-Hill confirmed a data breach stemming '
                'from a misconfigured Salesforce environment, allowing hackers '
                'to access a limited set of internal data. The company '
                "disputed ShinyHunters' claims of 45 million records being "
                'compromised, stating the exposed data was non-sensitive and '
                'did not include customer databases or core systems.',
 'impact': {'data_compromised': 'Limited internal data (non-sensitive)',
            'identity_theft_risk': 'Low (no SSNs or financial details exposed)',
            'payment_information_risk': 'Low (no payment information exposed)',
            'systems_affected': 'Misconfigured Salesforce webpages'},
 'initial_access_broker': {'entry_point': 'Misconfigured Salesforce '
                                          'environment'},
 'investigation_status': 'Ongoing',
 'motivation': 'Extortion',
 'post_incident_analysis': {'corrective_actions': 'Reinforcing protections and '
                                                  'addressing misconfiguration '
                                                  'with Salesforce',
                            'root_causes': 'Salesforce misconfiguration '
                                           'impacting multiple clients'},
 'references': [{'source': 'ShinyHunters dark-web portal'}],
 'response': {'containment_measures': 'Affected webpages secured immediately',
              'remediation_measures': 'Collaborating with Salesforce to '
                                      'reinforce protections and address '
                                      'misconfiguration',
              'third_party_assistance': 'External cybersecurity experts'},
 'threat_actor': 'ShinyHunters',
 'title': 'McGraw-Hill Data Breach via Salesforce Misconfiguration',
 'type': 'Data Breach',
 'vulnerability_exploited': 'Salesforce misconfiguration'}