Infinite Campus - Reports Hack After ShinyHunters Attempt

What Happened

On March 25, 2026, Infinite Campus, a U.S. education technology provider, reported a data breach linked to an extortion attempt by the notorious ShinyHunters hacking group. The breach was traced back to the compromise of an employee's Salesforce account. The attackers threatened to leak sensitive data they claimed to have stolen from the K-12 student information system, prompting immediate action from the company.

Upon investigation, Infinite Campus found that the breach primarily involved names and contact details of school staff. Fortunately, no sensitive customer databases were compromised. The company's founder and CEO, Charlie Kratsch, confirmed this in breach notices sent to customers, emphasizing that only publicly available data had been accessed.

Who's Affected

The breach affects various educational institutions that utilize Infinite Campus's services. As a provider for K-12 education, the compromised data could potentially impact many school staff members. Although the breach did not expose sensitive student information, the incident raises alarms about the security of educational technology systems.

The incident comes on the heels of another significant breach in the education sector, where 62 million students had their sensitive information compromised in the PowerSchool hack. This pattern of attacks highlights the growing risks faced by educational institutions in the digital age.

What Data Was Exposed

The investigation revealed that the attackers accessed limited data, specifically names and contact information of school staff. This type of information, while not as sensitive as student records, can still be exploited for phishing attacks or other malicious purposes. The fact that no customer databases were compromised is a relief, but the breach still poses a risk to the reputation and trust of Infinite Campus.

As a precaution, Infinite Campus has deactivated certain services for customers lacking IP address restrictions and is actively scanning all Salesforce data in collaboration with its partners to ensure no further vulnerabilities exist.

What You Should Do

For educational institutions using Infinite Campus, it is crucial to remain vigilant. Ensure that all staff are aware of the breach and encourage them to monitor their email and communication channels for any suspicious activity.

Here are some recommended actions:

• Change passwords: Encourage staff to update their passwords, especially for accounts linked to Salesforce.
• Enable two-factor authentication: This adds an extra layer of security to accounts.
• Educate staff: Provide training on recognizing phishing attempts and other social engineering tactics.

By taking these steps, educational institutions can better protect themselves against potential fallout from this breach and future threats.