Skip to content
DysruptionHub
Sign in Subscribe

Infinite Campus Salesforce intrusion

Summary

Infinite Campus logo

An unauthorized actor accessed an Infinite Campus employee’s Salesforce account March 18, 2026, prompting the company to disable some customer-facing services while investigating an extortion demand. ShinyHunters claimed the intrusion, and data associated with about 137,100 school-staff accounts was publicly released and indexed; Infinite Campus did not name the actor. The service disruption is presumed resolved, while data publication is confirmed.

Key facts

Timeline

  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted location

Organization types

Critical infrastructure sector

DysruptionHub coverage

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Presumed Resolved
Incident confidence:
High
Ransomware:
Confirmed
Attribution:
Medium

DD-CIT assessment

OC-ODOfficial cyberOfficial disruptionAbout the DD-CIT methodology

The organization publicly identifies the event as cyber-related. The organization publicly documents the resulting service disruption.

Attack mechanisms

Data impacts

  • Unauthorized data access

    An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.

  • Data theft or exfiltration

    Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.

  • Data publication or leak

    Stolen, exposed, or otherwise compromised data was publicly released, posted, distributed, or offered for download.

Operational impacts

  • Application unavailable

    A specific application or software platform became unavailable or unusable.

  • Third-party service disruption

    The incident materially affected services delivered by or through a vendor, managed service provider, contractor, partner, or other third party.

  • Downstream organization impact

    The incident caused operational effects at customers, affiliates, subsidiaries, partners, tenants, or other dependent organizations.

Extortion indicators

  • Ransom demand

    The victim received a demand for payment in exchange for restoring access, decrypting systems, preventing disclosure, or stopping another threatened action.

  • Data-theft extortion

    The actor threatened to disclose, sell, distribute, or otherwise misuse stolen data unless the victim paid or complied with demands.

  • Public leak threat

    The actor explicitly threatened to publish or publicly release victim data or incident details.

  • Countdown or payment deadline

    The actor imposed a deadline or public countdown before increasing the demand, publishing data, deleting keys, or taking another threatened action.

  • Full data publication

    The actor published or released a substantial or complete set of allegedly stolen victim data.

Incident narrative

Analyst assessment

Infinite Campus experienced a confirmed unauthorized-access and data-extortion incident after an intruder accessed an employee’s Salesforce account March 18, 2026. The company disabled certain customer-facing services while it investigated an extortion demand. BleepingComputer reported that ShinyHunters listed Infinite Campus and set a March 25 deadline to begin negotiations.

Infinite Campus did not name the actor. The stable ShinyHunters claim aligns with the company’s account of Salesforce access and extortion, supporting medium-confidence attribution rather than confirmation.

Operational significance

Services for customers without IP restrictions were disabled, and support teams assisted districts with reactivation. That produced downstream access problems for some school systems. Infinite Campus serves more than 3,200 U.S. districts and 11 million students in 46 states, so the supported impact area is nationwide rather than limited to its Blaine, Minnesota, headquarters.

The company said customer databases were not accessed and described the exposed Salesforce material as mostly school-staff directory information. Have I Been Pwned later indexed an Infinite Campus dataset containing about 137,100 addresses. HIBP describes listed breaches as data illegally accessed and released publicly, supporting confirmed data publication.

Current status

The operational disruption is presumed resolved because the latest dated service effects were observed March 26 and no newer evidence shows continuing interruption. Public release of data changes the confidentiality impact but does not reset the operational-impact clock.

Confidence and uncertainty

Confidence is high that unauthorized Salesforce access, an extortion demand, precautionary customer-service shutdowns and public data release occurred. ShinyHunters remains linked at medium confidence because its claim and later publication align, but Infinite Campus did not identify the actor. The incident involves data extortion; public evidence does not establish encryption-based ransomware.

Analytic gaps

Public sources do not establish the exact credential-compromise path, complete records taken, affected district count, dwell time, whether support tickets contained sensitive non-directory information, payment discussions or independent forensic attribution to ShinyHunters.

Threat actor and claim

ShinyHunters

View claim
Listed as: Infinite CampusSource: otherPublished:

Claim details

ShinyHunters listed Infinite Campus and posted a March 25, 2026, extortion deadline after claiming access to Salesforce data. Infinite Campus confirmed unauthorized access to an employee Salesforce account and an extortion attempt but did not name the actor. Have I Been Pwned later indexed an Infinite Campus dataset containing about 137,100 addresses as publicly released breach data, which aligns with the claim’s threatened outcome. The claim and publication support medium-confidence linkage but do not independently confirm forensic attribution, encryption-based ransomware or payment.

Organizations involved

Impacted location

Sources

Infinite Campus warns of breach after ShinyHunters claims data theft
BleepingComputerPublished: Retrieved:
  • Type: News Report
  • Stance: Report
  • Platform: Website
  • Medium: Web Page
  • Confidence: High

ShinyHunters claimed the attack, threatened to leak alleged stolen data and set a March 25 negotiation deadline; Infinite Campus said it would not negotiate.

Who's Been Pwned: Infinite Campus
Have I Been PwnedRetrieved:
  • Type: Research Threat Intelligence
  • Stance: Confirm
  • Platform: Website
  • Medium: Web Page
  • Confidence: High

Have I Been Pwned lists Infinite Campus with about 137,100 affected addresses and defines a listed breach as an incident in which data was illegally accessed and released publicly.

Gazetteer Files
U.S. Census BureauRetrieved:
  • Type: Public Record
  • Stance: Report
  • Platform: Website
  • Medium: Web Page
  • Confidence: High

The Census Bureau Gazetteer Files provide authoritative geographic reference data for states, counties, county equivalents and places in the United States.

Infinite Campus official website
Infinite CampusRetrieved:
  • Type: Public Record
  • Stance: Report
  • Platform: Website
  • Medium: Web Page
  • Confidence: High

The organization’s official website describes its identity, services, operating role and public or customer-facing programs.

Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.