Infinite Campus Data Breach Exposes 137,000 Users’ Personal Data

Key Takeaways

• A data breach at Infinite Campus, a leading student information system, has compromised the personal data of approximately 137,000 individuals.
• The cybercriminal group ShinyHunters is responsible for the breach, which occurred in March 2026 as part of a “pay or leak” extortion scheme.
• Exposed data includes names, email addresses, phone numbers, physical addresses, usernames, job titles, employers, and internal support tickets, primarily affecting school staff.
• While much of the data is considered directory information, its aggregation poses increased risks for targeted attacks and social engineering.
• Infinite Campus is notifying affected individuals and recommending strong password practices and multi-factor authentication.

Infinite Campus Suffers Data Breach Affecting 137,000 Users

Infinite Campus, a widely deployed student information system across K-12 educational institutions in the United States, has publicly disclosed a significant data breach impacting roughly 137,000 individuals.

ShinyHunters Group Claims Responsibility

The incident has been attributed to the notorious cybercriminal collective ShinyHunters, known for its extensive history of large-scale data theft and extortion. The breach reportedly took place in March 2026, stemming from a “pay or leak” operation initiated by the group.

ShinyHunters allegedly exfiltrated sensitive information and subsequently demanded a ransom to prevent its public release. Following claims that their demands were not met, the group proceeded to publish the purportedly stolen dataset.

Details of Exposed Information

Reports from Have I Been Pwned and official company statements confirm that the compromised data includes a range of personal identifiers. This encompasses email addresses, full names, telephone numbers, physical addresses, usernames, job titles, employer details, and internal support tickets.

Infinite Campus has indicated that a substantial portion of the exposed data comprises directory information related to school staff, which is frequently accessible through public institutional websites. However, cybersecurity experts caution that the consolidation of such information into a single, comprehensive dataset significantly escalates the potential for misuse by malicious actors.

Although the breach predominantly affects school personnel rather than students, the exposure of support tickets is particularly concerning. These tickets could furnish threat actors with valuable context about internal systems, potentially enabling them to develop more sophisticated and targeted attack strategies.

Attack Vector Remains Undisclosed

The precise technical methodology employed by the attackers to gain unauthorized access has not yet been publicly detailed. Nevertheless, the nature of the data compromised suggests a potential breach of backend systems or critical support infrastructure.

ShinyHunters has a track record of exploiting vulnerabilities related to exposed databases and stolen credentials. The group frequently disseminates stolen data via underground forums, a tactic designed to exert pressure on victim organizations and amplify reputational damage.

The ongoing activities of ShinyHunters underscore persistent weaknesses in access control mechanisms and data protection protocols within organizations that manage substantial volumes of user information.

Infinite Campus Response and User Recommendations

Infinite Campus has commenced the process of notifying all affected individuals and is advising users to exercise heightened vigilance. Even if the exposed information appears to be of low sensitivity, it can still be weaponized for phishing campaigns, identity-based attacks, and social engineering efforts.

What You Should Do

• Immediately update your passwords for Infinite Campus and any other associated accounts to strong, unique combinations.
• Enable multi-factor authentication (MFA) on all relevant accounts where it is available.
• Actively monitor your financial accounts and other online services for any suspicious or unauthorized activity.
• Exercise extreme caution with unexpected emails, text messages, or phone calls, particularly those referencing school-related services or Infinite Campus. Be wary of phishing attempts.
• Consider implementing identity theft protection services if you are concerned about potential misuse of your personal data.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.