BreachPublished 15 Jun 2026

Infinite Campus data breach affects 137,000 school staff accounts

Source Bleeping Computer

Description

The ShinyHunters extortion gang stole personal information from more than 137,000 school staff accounts in a Salesforce data theft attack that targeted the widely used Infinite Campus K-12 student information system in March. [...]

Impact

The breach exposed personally identifiable information (PII) of more than 137,000 school staff members, including names, email addresses, phone numbers, physical addresses, job titles, usernames, and support tickets. Although Infinite Campus indicated that most of the data was publicly available directory information and there was no evidence of customer database compromise, the exposure of such data could facilitate targeted phishing or social engineering attacks against affected individuals. No direct evidence of further exploitation or broader system compromise has been reported.

Defensive guidance

Infinite Campus has notified affected customers and stated that the exposed data largely consists of publicly available information. Organizations using Infinite Campus should follow any guidance from the vendor and monitor communications for updates. Given the nature of the breach, affected individuals should be advised to remain vigilant against phishing and social engineering attempts.

References

bleepingcomputer.com/news/security/infinite-campus-data-breach-affects-137-000-school-staff-accounts/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 15 Jun 2026, 12:45 UTC

References

Community reviews

Related threats