The ShinyHunters extortion gang breached Infinite Campus, a K-12 student information system used by over 3,200 US school districts, by targeting its Salesforce instance in March. The attack exposed personal data from 137,100 school staff accounts, including names, email addresses, phone numbers, physical addresses, job titles, and support tickets. Have I Been Pwned confirmed the breach scope after ShinyHunters leaked a 1.2GB archive. Infinite Campus stated no student databases were compromised and that most exposed data was directory-level information. The incident is compared to the December 2024 PowerSchool hack, though far smaller in scale. ShinyHunters has been on an active Salesforce-targeting campaign, claiming over 1.5 billion records stolen across hundreds of companies, and has also recently exploited an Oracle PeopleSoft zero-day.
