Edition 15 | April 19, 2026
Edtech giant McGraw Hill confirmed on April 16 that the ShinyHunters extortion group obtained personal data on 13.5 million accounts, including names, physical addresses, phone numbers, and email addresses, across more than 100GB of leaked files. The attackers did not break McGraw Hill's perimeter. They exploited a misconfiguration inside the company's Salesforce environment, the same cloud platform used by thousands of schools, districts, and edtech vendors. ShinyHunters published the stolen data on their dark web leak site after extortion negotiations apparently failed. McGraw Hill described the incident as part of a broader Salesforce configuration issue that has affected multiple organizations.
Why it matters: This is the largest textbook-vendor breach on record. If your district buys or licenses McGraw Hill content, confirm whether any staff, teacher, or student records were shared with their Salesforce environment. More importantly, audit every edtech vendor on your roster for cloud configuration practices. The attack vector was not a zero-day. It was a setting.
More than half of U.S. school districts reported a cybersecurity incident in 2025, a 16 percentage point jump year over year. The most dangerous gap is not teachers or IT staff, it is students. 93 percent of teachers and 97 percent of IT staff use multi-factor authentication, but only 13 percent of students do. Vendor breaches, meanwhile, exploded from 4 percent of K-12 incidents in 2023 to 32 percent in 2025. Four in five district leaders now say AI adoption is increasing their cyber risk, yet only 11 percent have a formal process to evaluate AI tools before purchase.
Why it matters: Cybersecurity in K-12 is no longer an advanced IT topic. It is a board-level governance issue. If your district has not rolled out student-side MFA, built a formal vendor-risk process, and written an AI evaluation policy, you are not behind, you are exposed. The McGraw Hill breach above is exactly the vendor-risk category this data warns about.
Google expanded NotebookLM access to all Google Workspace for Education users regardless of age and to individual consumers 13 and up, lowering the prior 18-plus floor. Younger users get the same core features teachers already know: Audio Overviews (podcast-style summaries), interactive Mind Maps, and Video Overviews that convert notes, PDFs, and images into visual presentations. Google says content filters are stricter for users under 18 to block inappropriate responses, and the company explicitly states that student chats and uploads are not reviewed by humans and are not used to train AI models. The move comes as OpenAI has launched a study mode for ChatGPT, signaling intensifying competition for the middle-school and high-school research workflow.
Why it matters: A top-tier AI research tool is now legally accessible to every middle school student with a school account. Teachers should pilot NotebookLM before students show up using it, and district policies should address audio and video overview generation, source-grounded research, and how AI-assisted notes interact with academic integrity standards.
Google Classroom now lets teachers feed text or a Google Drive file into Gemini and receive a ready-made quiz. Teachers pick grade level, number of questions, and format (multiple choice or open-ended), then export directly to Google Docs or Forms. The feature requires the Gemini Education add-on at $24 per user per year, or Gemini Education Premium at $36 per user.
Why it matters: Quiz generation is one of the highest-leverage uses of AI for teachers because it saves hours per week. But the paywall means well-funded districts adopt it and budget-strapped districts do not, widening the AI productivity gap between the two. If your district does not have Gemini Education, alternatives like MagicSchool and Curipod cover the same workflow at free and lower-cost tiers.
In an analysis published at Campus Technology, Quality Matters executive director Deb Adair names the three shifts she expects to separate strong institutions from weak ones this year. First, AI-driven instructional design: "The easier it becomes to generate content, the more important high-quality instructional design becomes." Second, the digital student experience becomes a strategic differentiator as learners compare institutions on the quality of their digital touch points. Third, online credential quality must be proven under new ADA Title II accessibility requirements and a crowded credential marketplace.
Why it matters: Tighter budgets plus expanding learner expectations plus AI tools is a combination most institutions are not staffed for. The colleges and universities that invest in instructional design capacity, treat digital experience as strategy rather than IT, and can demonstrate online course quality against federal standards will own 2026. The rest will spend the year scrambling.
EdTech Digest announced its 2026 finalists and winners for the Cool Tool, Leadership, and Trendsetter awards, covering K-12, higher education, and skills and workforce. Editor-in-Chief Victor Rivero framed this year's cohort as "defining what comes next" rather than reacting to change, reflecting a sector shifting from AI as novelty to AI as necessity. Past honorees span the market: Adobe, Blackboard, Discovery Education, DreamBox, Promethean, Scholastic, and SMART Technologies.
Why it matters: Awards lists are partly marketing, but they are also early signal of which tools teachers and procurement leads should know. The 2026 finalists list is a useful 30-minute scan for any instructional technology director drafting the next fiscal year's tool roadmap.
Microsoft launched a suite of AI-powered education tools that includes AI teaching assistants for lesson planning, real-time language translation, accessibility features, and analytics that track student engagement and comprehension. The stated goal is to reduce administrative burden on teachers so more time can go to mentorship and direct instruction. Microsoft emphasizes built-in data privacy and security safeguards as foundational, not an afterthought, as the company pushes generative AI deeper into its core educational platforms.
Why it matters: The direction is clear. AI will not live in standalone apps teachers have to learn separately, it will live inside the tools they already use. Microsoft's embedded approach raises the pressure on districts to evaluate vendor AI guardrails as part of the base platform contract, not as a later bolt-on.
MindPathTech's 2026 analysis names five trends already active in classrooms: hyper-personalized learning that adapts to individual learning styles and knowledge gaps, adaptive learning paths that modify in real time based on performance, blockchain for tamper-proof digital credentials and identities, VR and AR for immersive experiences such as virtual historical site visits, and accessibility infrastructure that narrows geographic, economic, and physical ability gaps. None of these are speculative. All five have shipping products in the market this quarter.
Why it matters: Most districts will not adopt all five simultaneously, and they should not. The smart play is to identify one pilot that addresses a specific equity gap or learning outcome, define evaluation metrics, and run the pilot for a full academic year before expanding. Chasing the trend list produces spend without improvement.
Illuminate Education reached a $5.1 million multi-state settlement with New York, California, and Connecticut over the 2021 and 2022 data breaches that exposed names, birth dates, student ID numbers, and demographic information. New York alone received $1.7 million, covering approximately 1.7 million current and former students across roughly 750 schools. The settlement forces Illuminate to encrypt all data, establish account management policies, limit access permissions, run continuous threat detection, track and patch vulnerabilities, delete data when contracts end, and send annual notifications to schools about what data categories are being collected.
Why it matters: State attorneys general are now running enforcement parallel to the FTC. Edtech vendors face financial exposure from both tracks simultaneously. Districts can and should cite this settlement in vendor contracts to demand the exact same technical and governance controls as baseline, not as premium add-ons.
The Federal Trade Commission finalized its consent order against Illuminate Education on February 17, 2026, closing the federal track on the same breach that exposed more than 10 million K-12 students in 2021 and 2022. The FTC cited Illuminate for storing student data in plain text until January 2022, ignoring vendor security warnings for more than two years, and failing to implement reasonable access controls, threat detection, and vulnerability patching. Under the order, Illuminate must build a formal data security program, delete student data that is not necessary for a specific educational purpose, and is barred from making misleading claims about its data practices. The order runs 10 years.
Why it matters: This consent order is now the federal baseline every edtech vendor will be measured against. Districts should use the order's specific requirements (plain-text storage banned, vendor warning response protocols, formal deletion workflows) as a vendor evaluation checklist. If a vendor cannot commit to these in writing, they should not be on the approved list.
Try This Week
Pull up your district or institution's approved edtech vendor list. For the top three vendors by user count, ask one question of your technology leadership: "Which cloud services do they use to store or process student data, and what public evidence do we have about those services' configuration hygiene?" The McGraw Hill breach this week was not a sophisticated attack. It was a setting. The districts that answer that question now will not be the ones answering it at a press conference later.
Until next time,
Dr. Janette Camacho
CEO, iTeachAI Academy
Free AI courses at classes.iteachai.co
17 free AI tools at iteachai.co/TeacherTools
Know a teacher who needs this? Forward this email.
Subscribe free at iteachaibot.com