Infinite Campus

In March 2026, ShinyHunters gained access to an Infinite Campus employee's Salesforce account. Infinite Campus is one of the largest Student Information System (SIS) providers in the United States, serving K-12 school districts with enrollment management, student records, and administrative functions.

According to notifications sent to affected individuals, the breach occurred on March 18, 2026. When extortion negotiations failed, ShinyHunters published the stolen data. The leak contained 137,123 unique accounts—students, workers, and administrators whose information passed through Infinite Campus support systems.

137,123 records containing email addresses, names, phone numbers, physical addresses, job titles, usernames, and support ticket contents. The Salesforce environment held customer support data—meaning communications between school districts and Infinite Campus about their SIS implementations.

Support tickets often contain more than intended. Troubleshooting student record issues, resolving access problems, discussing system configurations—these conversations can include student names, enrollment details, technical infrastructure information, and administrative credentials. The support system becomes an unintended repository of sensitive information.

School district administrators who contacted Infinite Campus support. IT staff whose usernames and contact details are exposed. Potentially students and families whose information appeared in support ticket discussions—anyone whose record was referenced while troubleshooting an issue.

Email addresses and names enable targeted phishing. Physical addresses and phone numbers enable social engineering. Job titles reveal who has administrative access to student data. For threat actors interested in education sector targets, this is reconnaissance data—a map of who controls student information systems across school districts.

Infinite Campus is a major SIS vendor trusted by thousands of school districts. Using Salesforce for customer relationship management is standard enterprise practice. Both are established platforms with security resources.

But the attack vector was a single employee account. One compromised credential provided access to the Salesforce environment. The security of 137,000 records depended on the credential hygiene of individual employees—not on platform security. Phishing, credential stuffing, or infostealer malware on one person's device becomes a breach of everyone in the CRM.

Support systems accumulate data across years of customer interactions. Old tickets, closed cases, resolved issues—they persist unless actively deleted. How many of those 137,000 records represented active support relationships versus historical interactions from years past?

Salesforce environments grow organically. Ticket attachments, email threads, account histories. Each support interaction adds data. Without retention policies that expire old tickets and purge unnecessary attachments, the CRM becomes an expanding archive of customer information—and all of it is in scope when an attacker gains access.

Infinite Campus sent notifications to affected individuals. FERPA implications must be assessed—if student records appeared in support tickets, educational record protections apply. Each school district that used Infinite Campus support must determine whether their students or staff were affected.

This is a vendor breach affecting customers downstream. School districts chose Infinite Campus as a trusted SIS provider. Now they must communicate to parents and staff about a breach they didn't cause but are affected by. The reputational and operational burden cascades from vendor to customer to community.