The ShinyHunters extortion group stole personal information from more than 137,000 school staff accounts during a Salesforce data theft attack targeting the widely used Infinite Campus K-12 student information system in March.
Infinite Campus is an education technology (EdTech) firm offering a student information system (SIS) to more than 3,200 school districts across the United States, handling data for 11 million students across 46 states.
While it did not link the incident to a particular hacking group when alerting customers to the breach in March, Infinite Campus characterized the attacker as "part of a group known for targeting the Salesforce accounts of hundreds of companies."
Infinite Campus also informed affected customers that the exposed data included names and contact details for school staff, along with other publicly accessible information, but noted it had found no evidence that customer databases had been compromised.
"Their target was the Infinite Campus Salesforce instance, consisting of names and contact information for school staff; the majority is directory information commonly found on school websites," it stated.
Although Infinite Campus did not provide additional details about the attack, the ShinyHunters data extortion group took responsibility for the breach on its data leak site and released a 1.2GB archive of documents allegedly containing Salesforce records with personally identifiable information (PII) and other internal corporate data.
Data breach notification service Have I Been Pwned examined the leaked data and reported today that the breach exposed data from 137,100 accounts, including unique names, email addresses, employers, job titles, phone numbers, physical addresses, usernames, and support tickets.
"The group subsequently published data they alleged was taken from Infinite Campus, containing 137k unique email addresses along with names, phone numbers, physical addresses and support tickets," Have I Been Pwned said.
"Infinite Campus subsequently sent notifications, advising that the exposed data largely consisted of 'names and contact information for school staff' and that 'the majority is directory information commonly found on school websites'."
The Infinite Campus incident closely resembles the December 2024 PowerSchool hack, but the impact differs significantly, as the PowerSchool breach affected 62 million students. The hacker behind that attack, a 19-year-old college student from Massachusetts, was also sentenced to 4 years in prison following a guilty plea in May 2025.
Over the past year, ShinyHunters has targeted numerous Salesforce customers, claiming to have stolen over 1.5 billion records after breaching hundreds of companies in the Salesloft Drift hack and the Salesforce Aura campaign.
More recently, the extortion group has taken credit for a new data theft campaign exploiting a zero-day vulnerability in Oracle's PeopleSoft enterprise business software suite to steal data from more than 100 organizations, including the University of Nottingham.
Test every layer before attackers do
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
Related Articles:
7-Eleven confirms data breach claimed by the ShinyHunters gang
Home security giant ADT data breach affects 5.5 million people
Charter Communications data breach affects 4.9 million accounts
7-Eleven data breach exposes personal information of 185,000 people
Data breach at edtech giant McGraw Hill affects 13.5 million accounts