DBHunter
Infinity Member
Golden Member
- Joined
- August 23, 2025
- Messages
- 2,142
- Reaction score
- 4,260
- Points
- 113
- Thread Author
- #1
Mc-GrawHill | mheducation.com |
2026-04-11 | 13.5M Users
Description:
On April 11, 2026, McGraw-Hill (mheducation.com) suffered a data breach (and subsequent extortion) caused by the @ShinyHunters group. The breach occurred after the group gained access to data stored within Salesforce, resulting in the compromise of over 45 million records. The company stated that the incident exposed "a limited set of data from a webpage hosted by Salesforce on its platform." More than 100 GB of data was later publicly distributed after McGraw-Hill refused to pay the ransom (despite having annual revenue of $2.2 billion). The group released the stolen data on April 15, 2026. The dataset contains the original user data that was stolen (converted from JSONL to CSV to save on file size) and is 44.6 GB in size when decompressed (~3.73 GB compressed). It includes ~13,490,582 unique email addresses and an estimated total of 45,178,624 records across 12 files. The compromised data includes full names, email addresses, phone numbers, physical addresses, and more.
Records: 13,490,582 · Compressed: 3.39GB
in the press:
https://www.bleepingcomputer.com/news/se...on-threat/
Samples:
Code:
2026-04-11 | 13.5M Users
Description:
On April 11, 2026, McGraw-Hill (mheducation.com) suffered a data breach (and subsequent extortion) caused by the @ShinyHunters group. The breach occurred after the group gained access to data stored within Salesforce, resulting in the compromise of over 45 million records. The company stated that the incident exposed "a limited set of data from a webpage hosted by Salesforce on its platform." More than 100 GB of data was later publicly distributed after McGraw-Hill refused to pay the ransom (despite having annual revenue of $2.2 billion). The group released the stolen data on April 15, 2026. The dataset contains the original user data that was stolen (converted from JSONL to CSV to save on file size) and is 44.6 GB in size when decompressed (~3.73 GB compressed). It includes ~13,490,582 unique email addresses and an estimated total of 45,178,624 records across 12 files. The compromised data includes full names, email addresses, phone numbers, physical addresses, and more.
Records: 13,490,582 · Compressed: 3.39GB
in the press:
https://www.bleepingcomputer.com/news/se...on-threat/
Samples:
Code:
Code:
==> mh.my.site.com_Contact.csv <==
"Id","LastModifiedDate","Area_of_Specialty__c","Extension__c","Highest_Degree_School__c","Potential_Author__c","MDR_NID__c","Invite_Comments__c","OtherLongitude","ContactSource","OtherCity","Disqualified__c","PhotoUrl","IsDeleted","OtherGeocodeAccuracy","Office_Location__c","Online_Resume__c","Leased_Info__c","MailingCity","Gender__c","OtherStreet","Related_Contact__c","OtherLatitude","Tenured__c","Alternate_Email__c","Jigsaw","Business_Unit__c","OtherPhone","Description","AssistantName","MailingCountry","Salutation","MailingState","OwnerId","Highest_Degree__c","OtherCountry","Division","Source__c","EmailBouncedReason","FirstName","OtherPostalCode","Role__c","Support_Account__c","Author_Comments__c","MPSS_Rep_Name__c","SystemModstamp","LegacyId__c","HomePhone","Office_Hours__c","LastActivityDate","Highest_Degree_Date__c","Website__c","School_Phone__c","AccountId","Email","Account_Type__c","Competition_Author__c","MobilePhone","Name","Suffix__c","CreatedById","MailingLatitude","Customer_Type__c","Loyalty__c","Invite__c","MasterRecordId","Author__c","IsEmailBounced","LastViewedDate","Birthdate","CurrencyIsoCode","LeadSource","CreatedDate","LastName","MailingStreet","AssistantPhone","EmailBouncedDate","Contact_SubType__c","Contact_Qualification__c","Contact_Type__c","LastReferencedDate","OtherState","Phonetic_Name__c","MailingLongitude","Phone","MailingPostalCode","LastCUUpdateDate","MailingGeocodeAccuracy","Last_Activity_Datetime__c","Pref_Method_of_Contact__c","Title","MIG_Contact_Number__c","LastCURequestDate","ELC_Name__c","Reviewer__c","Reviewer_Comments__c","ReportsToId","Middle_Name__c","Fax","LastModifiedById","JigsawContactId"
"0030y00002DCK7QAAX","2021-06-19T20:38:13.000Z",,,,false,,,,,,false,,false,,,,,,,,,,false,,,"None",,,,,,,"00580000001jggLAAQ",,,"02d800000004CzBAAU","CMDB",,"ABELARDO",,,"001C000001Ao2r9IAB",,,"2021-06-19T20:38:13.000Z","900008524",,,,,,,"001C000001Ao2r9IAB","ninyure@yahoo.es","NA",false,,"ABELARDO FERNANDEZ",,"00580000001jggLAAQ",,,,,,,false,,,"USD",,"2017-10-22T04:11:48.000Z","FERNANDEZ",,,,,,,,,,,,,,,,"No preference",,,,,,,,,,"0051A00000Bx2JgQAJ",
"0030y00002DCK7RAAX","2020-06-15T23:52:53.000Z",,,,false,,,,,,false,,false,,,,,,,,,,false,,,"None",,,,,,,"00580000001jggLAAQ",,,"02d800000004CzBAAU","CMDB",,"CHERYL",,,"001C000001Ao2r9IAB",,,"2020-06-15T23:52:53.000Z","900008525",,,,,,,"001C000001Ao2r9IAB","cheryltobey@gmail.com","NA",false,,"CHERYL TOBEY",,"00580000001jggLAAQ",,,,,,,false,,,"USD",,"2017-10-22T04:11:48.000Z","TOBEY",,,,,,,,,,,,,,,,"No preference",,,,,,,,,,"0051A00000Bx2JgQAJ",
"0030y00002DCK7SAAX","2023-10-30T03:01:29.000Z",,,,false,,,,,,false,,false,,,,,,,,,,false,,,"None",,,,,,,"00580000001jggLAAQ",,,"02d800000004CzBAAU","CMDB",,"SONAL",,,"001C000001Ao2r9IAB",,,"2023-10-30T03:01:29.000Z","900008526",,,,,,,"001C000001Ao2r9IAB","sonal.jeethender@mheducation.com","NA",false,,"SONAL JEETHENDER KUMAR JAI",,"00580000001jggLAAQ",,,,,,,false,,,"USD",,"2017-10-22T04:11:48.000Z","JEETHENDER KUMAR JAI",,,,,,,,,,,,,,,,"No preference",,,,,,,,,,"005C0000005kobRIAQ",
"0030y00002DCK7TAAX","2020-06-15T23:52:53.000Z",,,,false,,,,,,false,,false,,,,,,,,,,false,,,"None",,,,,,,"00580000001jggLAAQ",,,"02d800000004CzBAAU","CMDB",,"ROCIO",,,"001C000001Ao2r9IAB",,,"2020-06-15T23:52:53.000Z","900008527",,,,,,,"001C000001Ao2r9IAB","rocio.leyva@atos.net","NA",false,,"ROCIO LEYVA",,"00580000001jggLAAQ",,,,,,,false,,,"USD",,"2017-10-22T04:11:48.000Z","LEYVA",,,,,,,,,,,,,,,,"No preference",,,,,,,,,,"0051A00000Bx2JgQAJ",
==> mh.my.site.com_Contact_CXG_1.csv <==
"Id","LastModifiedDate","Area_of_Specialty__c","Extension__c","Highest_Degree_School__c","Potential_Author__c","MDR_NID__c","Invite_Comments__c","OtherLongitude","ContactSource","OtherCity","Disqualified__c","PhotoUrl","IsDeleted","OtherGeocodeAccuracy","Office_Location__c","Online_Resume__c","Leased_Info__c","MailingCity","Gender__c","OtherStreet","Related_Contact__c","OtherLatitude","Tenured__c","Alternate_Email__c","Jigsaw","Business_Unit__c","OtherPhone","Description","AssistantName","MailingCountry","Salutation","MailingState","OwnerId","Highest_Degree__c","OtherCountry","Division","Source__c","EmailBouncedReason","FirstName","OtherPostalCode","Role__c","Support_Account__c","Author_Comments__c","MPSS_Rep_Name__c","SystemModstamp","LegacyId__c","HomePhone","Office_Hours__c","LastActivityDate","Highest_Degree_Date__c","Website__c","School_Phone__c","AccountId","Email","Account_Type__c","Competition_Author__c","MobilePhone","Name","Suffix__c","CreatedById","MailingLatitude","Customer_Type__c","Loyalty__c","Invite__c","MasterRecordId","Author__c","IsEmailBounced","LastViewedDate","Birthdate","CurrencyIsoCode","LeadSource","CreatedDate","LastName","MailingStreet","AssistantPhone","EmailBouncedDate","Contact_SubType__c","Contact_Qualification__c","Contact_Type__c","LastReferencedDate","OtherState","Phonetic_Name__c","MailingLongitude","Phone","MailingPostalCode","LastCUUpdateDate","MailingGeocodeAccuracy","Last_Activity_Datetime__c","Pref_Method_of_Contact__c","Title","MIG_Contact_Number__c","LastCURequestDate","ELC_Name__c","Reviewer__c","Reviewer_Comments__c","ReportsToId","Middle_Name__c","Fax","LastModifiedById","JigsawContactId"
"0030y00002DCK7QAAX","2021-06-19T20:38:13.000Z",,,,false,,,,,,false,,false,,,,,,,,,,false,,,"None",,,,,,,"00580000001jggLAAQ",,,"02d800000004CzBAAU","CMDB",,"ABELARDO",,,"001C000001Ao2r9IAB",,,"2021-06-19T20:38:13.000Z","900008524",,,,,,,"001C000001Ao2r9IAB","ninyure@yahoo.es","NA",false,,"ABELARDO FERNANDEZ",,"00580000001jggLAAQ",,,,,,,false,,,"USD",,"2017-10-22T04:11:48.000Z","FERNANDEZ",,,,,,,,,,,,,,,,"No preference",,,,,,,,,,"0051A00000Bx2JgQAJ",
"0030y00002DCK7RAAX","2020-06-15T23:52:53.000Z",,,,false,,,,,,false,,false,,,,,,,,,,false,,,"None",,,,,,,"00580000001jggLAAQ",,,"02d800000004CzBAAU","CMDB",,"CHERYL",,,"001C000001Ao2r9IAB",,,"2020-06-15T23:52:53.000Z","900008525",,,,,,,"001C000001Ao2r9IAB","cheryltobey@gmail.com","NA",false,,"CHERYL TOBEY",,"00580000001jggLAAQ",,,,,,,false,,,"USD",,"2017-10-22T04:11:48.000Z","TOBEY",,,,,,,,,,,,,,,,"No preference",,,,,,,,,,"0051A00000Bx2JgQAJ",
"0030y00002DCK7SAAX","2023-10-30T03:01:29.000Z",,,,false,,,,,,false,,false,,,,,,,,,,false,,,"None",,,,,,,"00580000001jggLAAQ",,,"02d800000004CzBAAU","CMDB",,"SONAL",,,"001C000001Ao2r9IAB",,,"2023-10-30T03:01:29.000Z","900008526",,,,,,,"001C000001Ao2r9IAB","sonal.jeethender@mheducation.com","NA",false,,"SONAL JEETHENDER KUMAR JAI",,"00580000001jggLAAQ",,,,,,,false,,,"USD",,"2017-10-22T04:11:48.000Z","JEETHENDER KUMAR JAI",,,,,,,,,,,,,,,,"No preference",,,,,,,,,,"005C0000005kobRIAQ",
"0030y00002DCK7TAAX","2020-06-15T23:52:53.000Z",,,,false,,,,,,false,,false,,,,,,,,,,false,,,"None",,,,,,,"00580000001jggLAAQ",,,"02d800000004CzBAAU","CMDB",,"ROCIO",,,"001C000001Ao2r9IAB",,,"2020-06-15T23:52:53.000Z","900008527",,,,,,,"001C000001Ao2r9IAB","rocio.leyva@atos.net","NA",false,,"ROCIO LEYVA",,"00580000001jggLAAQ",,,,,,,false,,,"USD",,"2017-10-22T04:11:48.000Z","LEYVA",,,,,,,,,,,,,,,,"No preference",,,,,,,,,,"0051A00000Bx2JgQAJ",
==> mh.my.site.com_Web_Product_Refund_Header__History.csv <==
"Id","ParentId","IsDeleted","NewvalString","NewvalNumber","Field","CreatedById","CreatedDate","DataType","Division","OldvalNumber","OldvalString"
"0170y0000suZviDAAS","aCb0y000000Gmu4CAC",false,"Ready to Send to Oracle",,"Interface_Status__c","0050y00000E2QfoAAF","2020-01-02T14:39:33.000Z","DynamicEnum","02d800000004CzBAAU",,
"0170y0000suZyu2AAC","aCb0y000000Gmu4CAC",false,"INSERTED",,"Interface_Action__c","00580000001jggLAAQ","2020-01-02T14:49:10.000Z","DynamicEnum","02d800000004CzBAAU",,"INSERT"
"0170y0000suZyu3AAC","aCb0y000000Gmu4CAC",false,"Sent to Oracle",,"Interface_Status__c","00580000001jggLAAQ","2020-01-02T14:49:10.000Z","DynamicEnum","02d800000004CzBAAU",,"Ready to Send to Oracle"
"0170y0000sua6EpAAI","aCb0y000000Gmu9CAC",false,,,"created","0050y00000E2QfoAAF","2020-01-02T15:19:10.000Z","Text","02d800000004CzBAAU",,
==> mh.my.site.com_CaseComment.csv <==
"Id","ParentId","LastModifiedDate","IsDeleted","CommentBody","CreatedById","IsPublished","CreatedDate","Division","CommentBodyRichtext","LastModifiedById","SystemModstamp"
"00a0y00000xmcoGAAQ","5000y00001hyX6cAAE","2020-03-17T19:30:32.000Z",false,"From: Brex, Emily <emily.brex@mheducation.com> Sent: Tuesday, March 17, 2020 2:28 PM To: Hoffmeyer, Kristy <kristy.varan@mheducation.com>; NSS <NSS@Mheducation.com> Cc: Weidman, Naomi <Naomi.Weidman@mheducation.com>
==> mh.my.site.com_Case_1.csv <==
"Id","Origin","TestBank_Only","LastModifiedDate","MPSS_Hour_Case_Created","Product_Improvement","DateTimeToText","CreatedById","TextToNumConversion","Product","Status","TextConversion","IsDeleted","HasCommentsUnreadByOwner","Priority","Time_Created_Interval","CurrencyIsoCode","CreatedDate","Business_Unit","Description","Contact_Type","ContactId","IsClosed","Time_in_New","SuppliedEmail","OwnerId","Time_at_New","RecordTypeId","CaseNumber","Division","HasSelfServiceComments","TB_Only","Country","Time_Outside_Center","Support_Account","Subject","SystemModstamp","Time_in_Escalated","Interval","ContactEmail","Pin_Protected","LastModifiedById"
"5000y00001feP5yAAE","Self_Service",false,"2020-01-14T05:19:40.000Z",-54531.0,false,"04:56","0051A00000CMWoPQAX",4.0,"All Other Product","New","04.56",false,false,"Medium",23.0,"USD","2020-01-14T04:56:08.000Z","None","FirstName: segfrs LastName: segrsdg fsefsEmail: yurijsavinov6@gmail.com