Data breach
Udemy data breach
In 2026, Udemy suffered a data breach affecting 1,412,745 records. Exposed data included email addresses, names, surname and 4 other types of data.
Breach date
1.4 million
Records in the breach
7
Types of data exposed
Were you affected by the Udemy breach?
Enter your email address to see whether it appears in this breach — or any of the other breaches in Leak Database.
Data exposed in the Udemy breach
- Email Addresses
- Names
- Surname
- Phone Numbers
- Addresses
- Employment Information
- Financial Information
About the breach
In April 2026, the online learning platform Udemy was targeted in a "pay-or-leak" extortion attempt by the ShinyHunters cybercrime group.
Key Details of the Incident
• What happened: Threat actors claimed to have breached Udemy and leaked data after an unpaid ransom demand deadline.
• Scope: Approximately 1.4 million user records (affecting students and instructors) were claimed to be compromised.
• Exposed data types:
• Email addresses (approx. 1.4 million)
• Full names
• Phone numbers
• Physical/street addresses
• Employer and job title information
• Instructor payout details (such as PayPal, bank transfer, and cheque preferences)
• A small number of sensitive identifiers or internal corporate data
• Status: Udemy did not officially confirm or issue a widespread public statement regarding the extortion claim at the time of the leak. Separately, a smaller vishing-related incident affecting roughly 12,000 accounts was reported via regulatory disclosures (such as KVKK).
Key Details of the Incident
• What happened: Threat actors claimed to have breached Udemy and leaked data after an unpaid ransom demand deadline.
• Scope: Approximately 1.4 million user records (affecting students and instructors) were claimed to be compromised.
• Exposed data types:
• Email addresses (approx. 1.4 million)
• Full names
• Phone numbers
• Physical/street addresses
• Employer and job title information
• Instructor payout details (such as PayPal, bank transfer, and cheque preferences)
• A small number of sensitive identifiers or internal corporate data
• Status: Udemy did not officially confirm or issue a widespread public statement regarding the extortion claim at the time of the leak. Separately, a smaller vishing-related incident affecting roughly 12,000 accounts was reported via regulatory disclosures (such as KVKK).
How to protect yourself
In order to protect yourself, we recommend the following:
1. Monitor your credit report for any suspicious activities. If you cannot do this yourself, we recommend you consider making use of services doing this on your behalf.
2. Be aware of an increase in possible spam or scam emails you may receive. We recommend that you make use of Apps like True Caller to assist you in identifying any possible spam or spam calls.
1. Monitor your credit report for any suspicious activities. If you cannot do this yourself, we recommend you consider making use of services doing this on your behalf.
2. Be aware of an increase in possible spam or scam emails you may receive. We recommend that you make use of Apps like True Caller to assist you in identifying any possible spam or spam calls.
Get told about the next breach
A free Leak Database account emails you when your address appears in a newly added breach.