Infinite Campus 2026 Data Breach
The Infinite Campus 2026 data breach was linked, according to the company's account, to unauthorized access to an employee Salesforce account.
Exposed Data Types
8- Email addresses
- Employers
- Job titles
- Names
- Phone numbers
- Physical addresses
- Support tickets
- Usernames
About This Breach
Infinite Campus said it became aware of the incident on 18 March 2026, that the accessed environment contained school-staff names and contact details, and that most of this information was already available in school directories. The company also said it found no evidence that customer databases were accessed. The ShinyHunters name and the threat to publish data unless paid come from the attacker's claim; the company did not authenticate the actor's identity.
After data was published, a verified breach index reported 137,123 unique email addresses in the attributed archive. The index lists email addresses, employers, job titles, names, phone numbers, physical addresses, support tickets, and usernames as data classes. This is not a unique-person count and does not mean every field was present in every record. Production has no local import job or searchable person-level dataset linked to this incident, so 137,123 is not presented as a locally imported record count.
What does the evidence establish?
The company account supports access to an employee Salesforce account and its finding of no evidence that customer databases were compromised. Independent reporting later described an allegedly published archive of about 1.2 GB and the verified index's field analysis. This evidence does not establish exposure of student grades, health information, passwords, or the core student-information-system databases. The support-ticket class does not prove that every ticket contained the same information. A match alone does not show that a person is a student or parent or that a current Infinite Campus account is compromised.
Safe next steps
Affected school staff should be cautious of targeted phishing that uses an organization name, job title, or old support context. Instead of following a link that requests a password change, open the school's or Infinite Campus's known sign-in address directly and verify suspicious requests with the institution's IT team through a separate channel. If the same password was reused on another service, replace it with a unique password and enable multifactor authentication. An email match should not be used to infer additional facts about students or families.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
