Infinite Campus Reports Data Breach Following ShinyHunters Extortion Attempt Infinite Campus, a leading U.S.-based provider of K-12 student information systems, has notified customers of a data breach after a threat actor accessed an employee’s Salesforce account. The company serves over 3,200 school districts and manages data for 11 million students across 46 states. The breach was claimed by the extortion group ShinyHunters, which posted a "final warning" on its dark web site on March 24, threatening to leak stolen data unless Infinite Campus engaged in ransom negotiations by March 25. The company confirmed it would not comply with the demands. ShinyHunters alleged the theft of Salesforce records containing personally identifiable information (PII) and internal corporate data. However, Infinite Campus stated that its investigation found no access to customer databases. The exposed data primarily included names and contact details of school staff, much of which is publicly available on school websites. The incident follows a pattern of Salesforce-targeted attacks by ShinyHunters, which has breached hundreds of companies in the past year, including high-profile campaigns like the Salesloft Drift and Salesforce Aura hacks, claiming over 1.5 billion records stolen. In response, Infinite Campus disabled certain customer-facing services for users without IP restrictions and is scanning potentially compromised Salesforce data. The company is also contacting affected school districts to provide guidance. While the breach’s full impact remains unclear, Infinite Campus has not disclosed how many districts were affected. The incident echoes the December 2024 PowerSchool hack, though that attack exposed sensitive data of 62 million students. The perpetrator, a 19-year-old college student, was later sentenced to four years in prison.

Instructure Investigates Cybersecurity Breach Impacting Canvas LMS Users Instructure, the provider of Canvas one of the world’s leading learning management systems (LMS) has confirmed a cybersecurity incident involving a criminal threat actor. The company is actively investigating the breach with the assistance of external forensics experts to determine its full scope and impact. In a statement, Steve Proud, Instructure’s Chief Information Security Officer (CISO), acknowledged the incident and outlined initial response measures. The company has implemented heightened monitoring across its platforms and reissued certain security keys as a precaution, requiring some users to re-authorize access to affected tools. While there is no evidence the keys were misused, the move aims to mitigate potential risks. Preliminary findings suggest attackers may have accessed or exfiltrated user-identifying data, including full names, email addresses, student ID numbers, and messages. However, Instructure has stated there is no current evidence that more sensitive information such as passwords, dates of birth, government IDs, or financial details was compromised. Should this assessment change, the company has committed to notifying impacted institutions. Proud later confirmed that the incident has been contained and expressed gratitude for users’ patience while investigations continue. The breach reflects a growing trend of cyberattacks targeting educational technology platforms, which store vast amounts of personal data. Recent incidents include PowerSchool’s 2025 extortion attempt and Infinite Campus’s 2026 Salesforce breach, underscoring the sector’s vulnerability to threat actors.