Infinite Campus Exposes 137,123 Staff Records in ShinyHunters Extortion Breach
What Happened — In March 2026, the extortion group ShinyHunters targeted the student‑information system provider Infinite Campus, demanding payment to prevent public release of stolen data. After the deadline passed, the group published a dump containing 137,123 unique records – email addresses, names, phone numbers, physical addresses, job titles, usernames and support‑ticket excerpts belonging largely to school staff.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate third‑party oversight: a breach of a SaaS education platform can expose personally identifiable information of thousands of employees.
- Highlights the need for continuous monitoring and evidence collection on vendor security controls to satisfy audit‑ready postures.
- Reinforces the importance of a documented incident‑response and breach‑notification process that can be demonstrated to regulators and auditors.
Who Is Affected – K‑12 school districts, charter schools and other education institutions that rely on Infinite Campus for staff directory and support‑ticket management.
Recommended Actions
- Map this incident to your vendor‑risk management control objective and verify that contracts require timely breach notification and security evidence.
- Initiate continuous monitoring of Infinite Campus (or any critical SaaS provider) using third‑party risk dashboards; collect security attestations, audit reports, and evidence of remediation.
- Review and test your incident‑response playbook for third‑party data breaches, ensuring you can produce a defensible audit trail.
Source: Have I Been Pwned – Infinite Campus breach
Technical Notes – The breach was disclosed as part of a “pay‑or‑leak” extortion campaign; the exact initial attack vector (e.g., credential theft, vulnerability exploit) was not publicly identified. Exfiltrated data includes staff‑level personally identifiable information (PII) and internal support‑ticket content.