2026 Udemy — ShinyHunters claims ~1.4M records (PII + internal; pay-or-leak ultimatum; Apr)
Data compromised
Actor-claimed user PII and internal corporate datasets—categories per ShinyHunters marketing
Technical writeup
In late April 2026, the extortion group ShinyHunters listed the online learning platform Udemy on its leak infrastructure, claiming roughly 1.4 million user records spanning PII and internal corporate material, with public reporting citing an April 27, 2026–style deadline in actor messaging. Trade coverage (e.g., eSecurity Planet) summarized the criminal narrative while emphasizing that full forensic confirmation from Udemy was not uniformly available in the first press wave. Treat record counts, overlap with prior leaks, and internal-data descriptions as claims pending independent verification.
Root cause
Unauthorized access alleged by extortion group; intrusion chain not fully public