Udemy Data Breach: ShinyHunters Claims 1.4 Million Records Compromised
On April 24, 2026, the ShinyHunters hacking group claimed responsibility for a data breach at Udemy, the online learning platform. The group alleged the theft of over 1.4 million user and corporate records, including personally identifiable information. ShinyHunters issued an ultimatum, threatening to leak the data if a ransom was not paid by April 27, 2026.
Signal context
First seen: Apr 24, 2026
Last updated: Jun 26, 2026
Status: Public signal
Key points
- ShinyHunters group claimed data theft from Udemy on April 24, 2026.
- Over 1.4 million user and corporate records allegedly compromised.
- Exposed data includes personally identifiable information, names, physical addresses, phone numbers, employer details, and instructor payout methods.
Signal analysis
BetaThis analysis groups the signal by industry, likely incident action and impacted security area. It helps compare this signal with other published signals without treating the labels as final determinations.
Sector: Information
Likely country: Location not provided
Watch process controls, misconfiguration and accidental disclosure paths.
- Source type: outside the affected organization
Impact area: Confidentiality
Likely asset: User or customer data
- 26 signals in the same sector
- 90 signals with the same likely impact area
- 1 signal linked to this organization/domain
External sources
Major Cyber Attacks, Data Breaches, Ransomware Attacks in April 2026https://www.cybersecurity-insiders.com/major-cyber-attacks-data-breaches-ransomware-attacks-in-april-2026/Public source from cybersecurity-insiders.com.
Udemy Data Breach - Have I Been Pwnedhttps://haveibeenpwned.com/PwnedWebsites#UdemyPublic source from haveibeenpwned.com.
Related signals
Grouped by why the signal is relevant.
Jeveuxaider.gouv.fr Data Leak Affects 550,000 Accounts
The French government announced on June 16, 2026, that its volunteering platform, Jeveuxaider.gouv.fr, had been a victim of a personal data leak. Approximately 550,000 user accounts were affected by the incident.
Dutch hospitals restore digital access after cyberattack on ChipSoft
On June 12, 2026, reports indicated that Dutch hospitals were restoring digital access following a cyberattack on ChipSoft, a major healthcare software provider. The attack had previously caused patient files to become inaccessible at multiple locations, leading fifteen hospitals to preventively block all electronic patient information. This measure forced doctors to revert to paper records and oral transfers. While the incident was not a data leak in the traditional sense, it was a significant attack on the health infrastructure of the Netherlands, carried out through a single supplier serving numerous hospitals.
NIFTY Corporation Affected by KDDI Corporation Data Breach
NIFTY Corporation, a Japanese internet service provider, was impacted by a data breach originating from an email system provided by KDDI Corporation. Threat actors gained unauthorized access to this shared system by exploiting a vulnerability in third-party software. This led to the potential exposure of up to 14.2 million email addresses and passwords across all affected ISPs. NIFTY Corporation customers' email addresses and passwords may have been compromised.
BIGLOBE Inc. Affected by KDDI Corporation Data Breach
BIGLOBE Inc., a Japanese internet service provider, was impacted by a data breach originating from an email system provided by KDDI Corporation. Threat actors gained unauthorized access to this shared system by exploiting a vulnerability in third-party software. This led to the potential exposure of up to 14.2 million email addresses and passwords across all affected ISPs. BIGLOBE Inc. customers' email addresses and passwords may have been compromised.
STNet, Inc. Affected by KDDI Corporation Data Breach
STNet, Inc., a Japanese internet service provider, was impacted by a data breach originating from an email system provided by KDDI Corporation. Threat actors gained unauthorized access to this shared system by exploiting a vulnerability in third-party software. This led to the potential exposure of up to 14.2 million email addresses and passwords across all affected ISPs. STNet customers' email addresses and passwords may have been compromised.
KDDI Web Communications Customer Data Affected by KDDI Email System Breach
KDDI Web Communications, a subsidiary of KDDI, was impacted by the data breach in KDDI Corporation's email system, disclosed on June 28, 2026. The incident, caused by a third-party software vulnerability, led to the potential exposure of up to 14.2 million email addresses and passwords belonging to customers across six Japanese ISPs, including KDDI Web Communications.