Misconfigured Salesforce Page Exposes 13.5 M McGraw Hill Education Records
What Happened – In April 2026 McGraw Hill disclosed that a misconfigured Salesforce‑hosted webpage allowed public download of more than 100 GB of data. The dump contained 13,500,136 unique records with email addresses, names, phone numbers and physical addresses.
Why It Matters for Trust & Control Assurance
- Continuous monitoring of cloud‑service configurations is a core control‑assurance activity; a single mis‑setting can create a massive data‑exposure event.
- Documented evidence of configuration reviews and remediation provides a defensible audit trail for privacy and security frameworks.
- Automated mapping of SaaS settings to control objectives helps demonstrate due‑diligence to regulators and partners.
Who Is Affected – Primarily students, teachers and staff whose personal information is stored in McGraw Hill’s education platforms (Education sector).
Recommended Actions
- Inventory all SaaS applications (Salesforce, etc.) and map each to relevant control objectives.
- Deploy automated configuration‑monitoring tools that generate continuous evidence of compliance.
- Update data‑handling policies and incident‑response playbooks to include SaaS‑specific misconfiguration scenarios.
Source: Have I Been Pwned – McGraw Hill breach
Technical Notes – The exposure stemmed from a misconfiguration of a publicly accessible Salesforce page, not a vulnerability in the underlying platform. No CVE is associated. Data types leaked: email, name, phone, address. Source: same as above