A software platform used by more than 11 million students in the United States was targeted in a cyberattack claimed by the notorious hacking group ShinyHunters. The incident involves Infinite Campus, a provider of student information systems used by more than 3,200 school districts across 46 states. The company manages student data, including academic records, attendance, and administrative information.
ShinyHunters, a cybercrime group known for data theft and extortion operations, claimed responsibility for the breach and threatened to release the data unless a ransom demand was met.
According to reports, the attackers gained access through an employee account linked to a cloud-based service. Salesforce was identified as the entry point, with the attackers accessing records stored in that system.
The company stated that its investigation found no evidence that core student databases were accessed. Instead, the exposed information was limited to names and contact details related to school staff, much of which was described as directory information already publicly available.
ShinyHunters said it had obtained a broader set of data and issued a deadline for the company to respond before releasing the material. The group published a notice on its dark website describing the incident as a “final warning.” The company said it would not engage with the attackers.
The incident follows a series of attacks linked to ShinyHunters targeting cloud-based software services and enterprise accounts. Security researchers have previously reported that the group uses methods such as social engineering and credential theft to gain access to systems, rather than exploiting software vulnerabilities directly.
Investigators and researchers have linked recent activity by the group to campaigns targeting single sign-on systems and cloud platforms, allowing attackers to move between connected services and extract data for use in extortion attempts.