The ShinyHunters hacker group released personal information of approximately 1.4 million users of the Udemy platform on April 26, 2026. The leak occurred after the company refused the criminals’ demands, who requested a ransom not to publish the data. The exposed records include names, addresses, phone numbers and payment information of affected users.
Dados personal and financial accounts were publicly exposed
The criminal group listed Udemy on a dark web site on April 24, setting a three-day deadline for compliance with the demands. Segundo documentation released, the leak contained more than 1.4 million records with internal and corporate information. The message published by the hackers indicated that the company had not responded to initial requests, leading to complete data exposure.
On the same topic: Capital One settles compensation of 425 million for security breach
The compromised records cover a wide range of sensitive user information. Analysis carried out by technology experts revealed that the data was organized in spreadsheets and made publicly available. Information includes details on payment methods such as PayPal, bank transfers, and digital wallets, as well as guidance for instructors on security and compliance procedures.
Informações included in the leak
- Full Nome and users’ date of birth.
- Números phone, cell phones and email addresses.
- Endereços residential or delivery services registered on the platform.
- Informações professionals, company names and corporate data.
- Documentos identification such as CPF, CNPJ and municipal records.
Exposing this data poses a significant risk to affected users. Criminosos can use the information to execute sophisticated phishing scams, simulating internal platform communications. Access to home data and phone numbers increases the likelihood of phone fraud and identity theft attempts. Especialistas recommend that users change their passwords immediately and monitor their bank accounts and digital wallets for suspicious activity.
Plataforma Have I Been Pwned confirms the incident
The Have I Been Pwned verification service has integrated the leak into its monitoring system. Troy Hunt, creator of the platform, highlighted that 56% of exposed email addresses had already been compromised in previous incidents. Essa information indicates that many users were already facing security risks before this leak, expanding existing vulnerabilities.
Users can check whether their email address was included in the incident for free by visiting haveibeenpwned.com. The tool displays whether the email is associated with the Udemy incident and provides guidance on protective measures. The site recommends enabling two-factor authentication on important accounts to strengthen security against unauthorized access. Essa additional layer of protection significantly reduces the risk of account compromise even if credentials are discovered.
More on this story: Meta’s artificial intelligence failure leaks confidential information during internal engineering test
ShinyHunters follows pattern of organized attacks
The ShinyHunters group is one of the most active cybercrime collectives in the current scenario. Nos In recent months, the organization has attacked companies such as Autotrade, Rockstar Games, healthcare institutions and small and medium-sized businesses. The operational pattern remains consistent: ransom demands, threats of data exposure, and public disclosure when demands are rejected. The approach does not vary between attacks.
In 2025, ShinyHunters was linked to the incident involving Salesforce. In another case, the group gained access to 2.5 million records from a home security company. Esses events demonstrate the group’s operational reach and its ability to compromise large-scale platforms. Udemy is one of the largest online course platforms in the world, with millions of students and instructors using the service for training and content sales. The leak mainly affects course creators, who depend on student trust to maintain their operations.
Recomendações for users and instructors
Usuários from Udemy should change their passwords as soon as possible and avoid reusing the same password on other services. It is essential not to share the same credential between different platforms, reducing the risk of cascading compromise. Nos in the coming days, it is recommended to monitor suspicious activity in bank accounts, be alert to email messages requesting confirmation of personal data and ignore communications that ask for sensitive information through unofficial channels.
Learn more: Anxiety for GTA 6 leads fans to extreme tactics like drones and fake documents against Rockstar
Udemy does not request confidential data through unofficial channels. Usuários Brazilians can use the Have I Been Pwned platform to perform quick checks of their email addresses. The service updates its database with public leak information and completes the process in just a few seconds, offering immediate peace of mind. Este incident reinforces the critical importance of data protection in digital services. Large Plataformas continue to be targeted by organized groups of hackers, and constant vigilance is essential to quickly identify compromises. Embora leaks cannot be completely prevented, informed users can protect themselves more effectively.