Infinite Campus notified customers in March 2026 after ShinyHunters claimed data theft from a compromised employee Salesforce account. On June 15, 2026, Have I Been Pwned and BleepingComputer reported that the published archive exposed 137,100 unique school staff accounts—not the earlier speculative student-scale figures tied to district reach.
HIBP said the trove included names, email addresses, employers, job titles, phone numbers, physical addresses, usernames, and support tickets. Infinite Campus maintained that attackers hit its Salesforce instance with staff directory-style contact data and that core student information system databases were not accessed.
Infinite Campus serves more than 3,200 U.S. school districts. Staff with K-12 roles should check Have I Been Pwned, enable MFA, and watch for phishing referencing real district or ticket details.
Canonical record: Infinite Campus 2026 breach on BreachHistory.
Sources: BleepingComputer, Have I Been Pwned