mheducation.com
Disclosed Sep 23, 2026
A breach of McGraw-Hill Education's Salesforce CRM instance (mh.my.site.com), exposing data including customer accounts, contacts, support cases, case comments, partner records, user data, and pricebook history. The data contains educator and student PII including names, emails, phone numbers, school affiliations, and internal support correspondence. Data spans records from approximately 2017 through 2023. Claimed by ShinyHunters with ransom-note flavor text indicating non-payment.
Data found in this dataset
Search this dataset
Team members search this dataset here and through the API. Access is by invitation from your team admin, or by request.
Source files
Expand any file to inspect its column headers and the field each maps to.
shouldve_paid_the_ransom_mcgrawhill-SHINYHUNTERS/mh.my.site.com_AccountPartner__records.csv0 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
Notes: All columns are internal IDs, timestamps, or flags — no PII present in this dataset.
shouldve_paid_the_ransom_mcgrawhill-SHINYHUNTERS/mh.my.site.com_Account__records.csv2 columns477,270 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
| Source column | Mapped field | Confidence |
|---|---|---|
| 80 | fullName | high |
| 114 | fullName | high |
Notes: Only fullName fields identified; all other columns are internal IDs, timestamps, flags, or non-PII metadata.
shouldve_paid_the_ransom_mcgrawhill-SHINYHUNTERS/mh.my.site.com_CaseComment__records.csv1 column100,324 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
| Source column | Mapped field | Confidence |
|---|---|---|
| 4 | emailText | high |
| free-text column with embedded emails (35/199 cells, 18% density) | ||
Notes: Heuristic auto-detection: header-named PII columns confirmed by data conformance
shouldve_paid_the_ransom_mcgrawhill-SHINYHUNTERS/mh.my.site.com_Case_1__records.csv2 columns29,799 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
| Source column | Mapped field | Confidence |
|---|---|---|
| 50 | high | |
| 78 | high |
Notes: 82 total columns; 2 PII (both email). Other columns are Salesforce case metadata, IDs, flags, timestamps, and system fields.
shouldve_paid_the_ransom_mcgrawhill-SHINYHUNTERS/mh.my.site.com_Case__records.csv5 columns13,407,957 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
| Source column | Mapped field | Confidence |
|---|---|---|
| 49 | high | |
| 50 | phone | high |
| 58 | phone | high |
| 63 | country | high |
| 77 | high |
Notes: Identified 5 PII columns: 2 emails, 2 phone numbers, and 1 country field. All other columns are internal IDs, timestamps, flags, or non-PII metadata.
shouldve_paid_the_ransom_mcgrawhill-SHINYHUNTERS/mh.my.site.com_Contact_CXG_1__records.csv4 columns7,471,224 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
| Source column | Mapped field | Confidence |
|---|---|---|
| 39 | firstName | high |
| 54 | high | |
| 58 | fullName | high |
| 73 | lastName | high |
Notes: Identified 4 PII columns: firstName (39), email (54), fullName (58), lastName (73). All others are internal IDs, timestamps, flags, or business-unit codes.
shouldve_paid_the_ransom_mcgrawhill-SHINYHUNTERS/mh.my.site.com_Contact_DTS__records.csv4 columns3,937,419 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
| Source column | Mapped field | Confidence |
|---|---|---|
| 39 | firstName | high |
| 54 | high | |
| 58 | fullName | high |
| 73 | lastName | high |
Notes: 4 PII columns identified: firstName, email, fullName, lastName. All other columns are internal IDs, timestamps, flags, or business codes and skipped per exclusion rules.
shouldve_paid_the_ransom_mcgrawhill-SHINYHUNTERS/mh.my.site.com_Contact__records.csv4 columns9,355,123 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
| Source column | Mapped field | Confidence |
|---|---|---|
| 39 | firstName | high |
| 54 | high | |
| 58 | fullName | high |
| 73 | lastName | high |
Notes: 4 PII columns: firstName, email, fullName, lastName. All others are internal IDs, timestamps, flags, or non-PII codes.
shouldve_paid_the_ransom_mcgrawhill-SHINYHUNTERS/mh.my.site.com_Partner__records.csv0 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
Notes: All columns are internal IDs, timestamps, flags, or references; no PII present in the sample.
shouldve_paid_the_ransom_mcgrawhill-SHINYHUNTERS/mh.my.site.com_PricebookEntryHistory__records.csv0 rows
shouldve_paid_the_ransom_mcgrawhill-SHINYHUNTERS/mh.my.site.com_User__records.csv5 columns176 rows
File structure
Format: CSV·Delimiter: Comma·Has header: yes·Quote: "
| Source column | Mapped field | Confidence |
|---|---|---|
| 42 | firstName | high |
| 64 | fullName | high |
| 81 | lastName | high |
| 115 | username | high |
| 206 | username | high |
Notes: Identified 5 PII columns from the first 50 rows of a CSV file. The remaining columns are either non-PII or carry no value in the sampled rows and are omitted.