ShinyHunters breach of Infinite Campus Salesforce instance exposes 137,000 staff records

A breach of K-12 student information platform Infinite Campus has left personal details for roughly 137,000 school employees exposed after the ShinyHunters extortion group obtained unauthorised access to the company's Salesforce environment in March. The incident adds to a growing list of attacks targeting Salesforce deployments across multiple industries.

What happened

Infinite Campus, whose student information system is used by more than 3,200 school districts across 46 states and manages records for around 11 million students, notified customers of the breach in March. The company described the attacker in general terms at the time — characterising the perpetrator as belonging to a group with a documented pattern of targeting Salesforce accounts at hundreds of organisations — without naming ShinyHunters directly.

The company said the compromised Salesforce instance held staff directory information: names, contact details, and similar data typically published on school websites. It stated that there was no evidence the underlying customer databases had been accessed.

ShinyHunters subsequently posted a 1.2 GB archive to its data leak site, claiming the files contained Salesforce records with personally identifiable information alongside internal corporate documents. Data breach notification service Have I Been Pwned reviewed the leaked material and determined that 137,100 unique accounts were affected. The exposed fields span a broad range of contact attributes — including email addresses, phone numbers, physical addresses, job titles, employer names, usernames, and support ticket records.

Why it matters

The breach sits inside a broader pattern of Salesforce-focused attacks attributed to ShinyHunters. The group has separately claimed responsibility for campaigns that netted more than 1.5 billion records in aggregate, including incidents tied to Salesloft's Drift platform and a wider effort exploiting weaknesses in the Salesforce Aura framework across hundreds of companies. Most recently, the group announced a separate campaign targeting a zero-day in Oracle's PeopleSoft software, with more than 100 organisations said to be affected.

For the education sector specifically, the Infinite Campus breach follows the December 2024 PowerSchool incident, though the scale differs considerably. The PowerSchool compromise affected roughly 62 million students, whereas the Infinite Campus exposure is limited to staff contact data rather than student records. The individual behind the PowerSchool attack — a 19-year-old college student from Massachusetts who pleaded guilty — was sentenced to four years in prison in May 2025.

The nature of the exposed data matters for affected staff. Support ticket records, in particular, may contain more sensitive contextual information than standard directory entries, and the combination of verified email addresses, physical addresses, and employer details creates a usable dataset for spear-phishing or social engineering.

What to watch

ShinyHunters has not yet faced meaningful disruption to its operations despite repeated high-profile claims. The group's pivot toward enterprise SaaS environments — Salesforce and now Oracle PeopleSoft — signals a shift away from cloud storage misconfigurations toward application-layer exploitation. Whether law enforcement action comparable to the PowerSchool sentencing materialises for ShinyHunters-linked actors remains an open question. Infinite Campus has not publicly disclosed whether it has completed a forensic review or implemented additional controls on its Salesforce environment following the incident.