ShinyHunters Listed 45 Million Salesforce Records From McGraw-Hill on a Dark Web Portal. The Deadline Passed Yesterday.

ShinyHunters is not a new actor. The group has operated for several years and built a track record of high-volume data theft followed by structured extortion campaigns. What distinguishes their 2026 activity is the operational cadence and the calibre of targets.

In 2026 alone, confirmed ShinyHunters victims include Rockstar Games, Hims & Hers (the telehealth company), and the European Commission — alongside McGraw-Hill. The breadth of targeting — entertainment, healthcare, public sector, education — is not opportunistic. It reflects a systematic approach to identifying cloud misconfiguration exposure across high-value organisations and monetising it through dark web extortion infrastructure the group controls.

ShinyHunters operates their own extortion portal on the dark web, a step beyond the typical ransomware group approach of posting victim listings on someone else's leak site. Running their own portal gives them direct control over publication timing, negotiation pressure, and data distribution — and makes their deadline commitments credible. When the clock on their portal runs out, they have both the technical capability and the financial incentive to follow through.

The McGraw-Hill breach was not caused by a zero-day vulnerability or a sophisticated exploit chain. It was caused by a misconfiguration — specifically, the way Salesforce hosted web pages on behalf of the organisation exposed data that should have been inaccessible to unauthenticated external requests.

Salesforce's Experience Cloud and related hosted page products allow organisations to build customer-facing portals, partner sites, and web pages powered by Salesforce data. When sharing rules, guest user access permissions, or object-level security is misconfigured, these pages can expose data through Salesforce's own APIs without any credential requirement.

This is not a novel attack class. Salesforce misconfiguration-based exposure has been a documented issue for several years. What changed in 2026 is that threat actors — including ShinyHunters — have added systematic Salesforce exposure scanning to their initial access reconnaissance workflows. McGraw-Hill is one of multiple organisations believed to be affected by the same misconfiguration class. The company confirmed the breach affected 'a webpage hosted by Salesforce on its platform' — language that describes a known exposure pattern in Salesforce's hosted infrastructure products.

The most operationally significant aspect of this breach is not the confirmed data — it is the discrepancy between what McGraw-Hill has confirmed and what ShinyHunters claims.

McGraw-Hill's statement is narrowly worded and carefully scoped: it explicitly states no SSNs, no financial data, no student data, no courseware, and no internal systems. This is the language of a legal disclosure designed to minimise reputational damage, and it is consistent with what a company would say if the exposed data was limited to marketing records, contact lists, or publicly accessible page content.

ShinyHunters claims 45 million records containing PII. That figure — if accurate — is not a data leak from a misconfigured public-facing page. It is a systematic extraction. The resolution of this discrepancy will come when, or if, ShinyHunters publishes the data. At that point, security researchers and affected individuals will be able to assess the actual scope independently of either party's characterisation.

For organisations with employees, customers, or partners who interact with McGraw-Hill's digital products, the practical guidance is the same regardless of who is right: assume exposure of any data you have shared with McGraw-Hill digital platforms and monitor accordingly.

Based on available intelligence, here is the sequence of events:

Five immediate actions for security and IT teams:

The McGraw-Hill breach is a case study in how cloud misconfiguration becomes a dark web intelligence product. ShinyHunters did not need a zero-day. They did not need to compromise a network perimeter or bypass an EDR. They needed a Salesforce-hosted page with a misconfigured sharing rule — and the infrastructure to turn that access into a 45-million-record claim and a ransom countdown.

The ransom deadline has passed. The data has not been published yet. But the window between 'deadline expired' and 'data released' is typically measured in days, not weeks. If you are a McGraw-Hill customer, partner, or employee with data on their platforms: monitor your exposure now, not after the publication.

And if your organisation uses Salesforce to host any public-facing pages: run the Health Check today. Not this quarter. Today. ShinyHunters is scanning for your misconfiguration right now, and they do not need an invitation.