ShinyHunters Publishes Infinite Campus Data in Extortion Campaign Linked to Salesforce, 137,000+ Emails Exposed
Published
Key Takeaways
- Targeted Attack: Infinite Campus was hit by a ShinyHunters "pay or leak" extortion campaign in March 2026.
- Data Published: The cybersecurity incident affected more than 137,000 unique email addresses tied to the system.
- Mostly Directory Info: Infinite Campus said the attackers accessed mostly school staff contact details via a Salesforce account.
The student information system Infinite Campus was targeted in March 2026 in a ShinyHunters "pay or leak" extortion campaign linked to a compromised Salesforce account. The group later published data it alleged was taken from Infinite Campus. The data breach containing over 137,000 compromised accounts was added to breach notification service Have I Been Pwned (HIBP) on June 15, 2026.
The "pay or leak" model the group used pressures victims to pay before stolen data is made public, ultimately posting the records. Yet, Infinite Campus says much of this information mirrors publicly available school directory details.
What ShinyHunters Published
ShinyHunters released a dataset it claimed came from Infinite Campus, and according to HIBP, the data contained 137,123 unique email addresses, along with related information. The breach involved the following confirmed data types:
- Email addresses
- Employers
- Job titles
- Names
- Phone numbers
- Physical addresses
- Support tickets
- Usernames
Infinite Campus sent notifications to affected parties following the data breach. The company's reported breach notification messages said an unnamed unauthorized actor accessed an employee's Salesforce account.
How Infinite Campus Responded
The company advised that the exposed data largely consisted of names and contact information for school staff. It also stated that the majority of the information is directory information commonly found on school websites, framing the exposure as less sensitive than a typical personal data breach.
Schools and staff connected to Infinite Campus should review the notifications they received for specific guidance tied to this incident.
Last month alone, ShinyHunters was connected to breaches of Charter Communications, Kemper Corporation, Ameriprise Financial, 7-Eleven Inc., Woflow Inc., and Vimeo.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular