Infinite Campus Data Breach (2026): What Was Exposed & What To Do

In March 2026, records from the student information system Infinite Campus were published online by a threat actor. The incident involved 137,000 unique email addresses along with associated names, phone numbers, physical addresses, and support tickets. Notifications sent by the company described the material as consisting largely of names and contact information for school staff, much of it already publicly available as directory information. The exposure raises immediate questions for school employees and any individuals whose details appear in support records held by districts that use the platform. Contact information and internal identifiers can be repurposed for targeted messages or account access attempts even when the data overlaps with public sources.

Inside the incident

The incident was reported on 18 March 2026. It followed a “pay or leak” extortion effort attributed to the group ShinyHunters. The group later published material it alleged had been taken from Infinite Campus, containing 137,000 unique email addresses together with names, phone numbers, physical addresses, and support tickets. No further details on the initial access method, exact timing of the intrusion, or total volume of files have been disclosed. Infinite Campus issued notifications to affected parties after the publication.

Inside shinyhunters

ShinyHunters is a threat actor group known for obtaining and distributing data from organisations through unauthorised access followed by extortion demands. The group has previously listed numerous companies on leak sites, offering data for sale or releasing samples when payments were not received. In this case the group claims the Infinite Campus records were obtained during such a campaign; that claim has not been independently verified beyond the publication of the material itself.

About Infinite Campus

Infinite Campus provides student information systems used by school districts to manage administrative records. These platforms commonly store data on staff, students, and families, including contact details, employment information, and records of support interactions. A compromise at a provider of this kind can affect multiple districts and the individuals whose information is held across those systems.

What data was at risk

The published material included the following categories:

• Email addresses
• Names
• Phone numbers
• Physical addresses
• Support tickets
• Usernames
• Employers
• Job titles

Infinite Campus stated that the exposed data largely consisted of names and contact information for school staff and that the majority constituted directory information commonly found on school websites. The precise scope of any additional records beyond those listed remains unconfirmed.

The real-world impact

Individuals whose contact details and support records were published face an increased likelihood of receiving unsolicited messages or attempts to use the information for account recovery or social engineering. Because much of the material overlaps with publicly available staff directories, the incremental risk is concentrated on the combination of identifiers and any internal support context that was not previously visible. For the organisation, the incident adds to the operational burden of breach notification and the need to review access controls around staff and support data.

If your data was in this breach

Review any notifications received from Infinite Campus or your school district for specific instructions. Change passwords on any accounts that reuse the exposed email address or username, and enable multi-factor authentication where available. Monitor email and phone channels for unusual activity. Readers can run a free exposure scan of their email address to check whether their information has surfaced in known breach data.

AICompiled with AI assistance from public sources and published under our editorial standards.