Infinite Campus warns of breach after ShinyHunters claims knowledge theft

Infinite Campus, a broadly used Okay-12 pupil data system, is warning prospects of a data breach following an extortion try by a menace actor.

Within the breach notification despatched to prospects, Infinite Campus states that hackers accessed an worker’s Salesforce account, exposing data that was largely publicly obtainable.

The corporate has not revealed an official assertion, however prospects reported the incident on varied public platforms.

The notification comes shortly after the info extortion group ShinyHunters claimed the assault and posted a “last warning” on its darkish website yesterday, threatening to leak all knowledge allegedly stolen from Infinite Campus.

The hackers gave the corporate till March 25 to provoke contact and negotiate a ransom to stop an information leak. Nevertheless, Infinite Campus mentioned that it’s going to not have interaction with the attacker.

ShinyHunters claims to have stolen Salesforce data containing personally identifiable data (PII) and varied inner company knowledge.

Infinite Campus is a U.S.-based schooling know-how (EdTech) firm that gives a pupil data system (SIS) to greater than 3,200 faculty districts in america. Presently, its software program functions handle knowledge of 11 million college students in 46 states.

Though Infinite Campus didn’t title ShinyHunters because the menace actor, it described the intruder as “a part of a bunch identified for focusing on the Salesforce accounts of a whole lot of corporations.”

The extortion group has been focusing on Salesforce prospects for the previous yr, breaching a whole lot of corporations and claiming greater than 1.5 billion data stolen within the Salesloft Drift hack and the newer Salesforce Aura marketing campaign. 

Infinite Campus has additionally said that, in accordance with its investigation, no buyer databases had been accessed. Uncovered knowledge consists of names and get in touch with particulars for varsity stuff and knowledge that’s generally obtainable publicly.

“Their goal was the Infinite Campus Salesforce occasion, consisting of names and get in touch with data for varsity workers; the bulk is listing data generally discovered on faculty web sites,” defined the agency.

In response to the incident, the agency has disabled sure customer-facing companies for customers with out IP handle restrictions to attenuate the chance of potential publicity of delicate knowledge.

On the identical time, it’s scanning all Salesforce knowledge which will have been compromised and is contacting probably impacted districts to supply steerage.

BleepingComputer has contacted Infinite Campus with questions on what number of faculty districts have been impacted, however an organization consultant shared with us the notification despatched to prospects with no further remark.

The incident resembles the December 2024 PowerSchool hack because of the sort of focused platform, although the impression scope was vastly totally different, exposing the delicate data of 62 million college students.

The hacker behind that assault, a 19-year-old school pupil from Massachusetts, was finally sentenced to 4 years in jail, following his responsible plea in Could 2025.

Replace [March 24, 11:37 EST]: Article edited to replicate that Infinite Campus shared with BleepingComputer the notification despatched to prospects.