Infinite Campus

About This Breach

In March 2026, Infinite Campus, a U.S. K-12 student information system used by thousands of school districts, was affected by a data breach after the threat actor group ShinyHunters gained access to an employee's Salesforce environment and exfiltrated customer relationship management data. The exposed data contained approximately 137 thousand unique email addresses, along with names, phone numbers, job titles, physical mailing addresses, CampusID usernames and support-case records belonging largely to school district and school staff. As the platform serves K-12 schools, the wider stolen dataset also referenced student academic records, though the published identity records were predominantly staff directory and contact information. No passwords were included. After Infinite Campus declined to pay the ransom, the data was published on ShinyHunters' data-leak site and subsequently distributed via Telegram.