ShinyHunters Salesforce Breach Exposes 137,000 Infinite Campus School Staff Accounts

The ShinyHunters extortion group stole personal information belonging to more than 137,000 school staff accounts from Infinite Campus, a widely used K-12 student information system. The data was obtained through a Salesforce data-theft attack that targeted Infinite Campus in March 2026. The incident is part of ShinyHunters’ broader campaign against organizations that use Salesforce. Affected school districts should review notifications from Infinite Campus and watch for phishing attempts referencing staff accounts.