Infinite Campus, Inc. Listed by shinyhunters Ransomware Group

On March 22, 2026, education technology provider Infinite Campus, Inc. appeared on the leak site of the shinyhunters ransomware group. The attackers claim to have exfiltrated internal files including Salesforce records containing PII, and issued a final warning with a March 25, 2026 deadline before public release of the data.

Confirmed Details from Reporting

Public reporting on the ransomware.live portal shows the listing includes screenshots and descriptions of compromised Salesforce data alongside other internal corporate files. The group updated the entry on March 23, 2026, labeling it a FINAL WARNING and threatening both data leakage and additional digital disruptions if their demands are not met. The exact number of individuals whose personal information was taken remains unknown, as neither Infinite Campus nor the attackers have published a full victim count.

Available reporting describes the exposed material as personally identifiable information pulled from the company’s Salesforce environment. No technical details about the initial access method have been confirmed in public sources.

Why This Matters for You and Your Family

If your child attends a school or district that uses Infinite Campus for enrollment, grading, health records, or family contact information, your details may now sit in an attacker’s archive. PII from education platforms typically includes names, addresses, dates of birth, phone numbers, email addresses, and sometimes Social Security numbers or guardian contact data. Once that information leaves the vendor’s control, it can be sold, traded, or used to target you directly.

Families rarely realize how many records they have inside school systems until after a breach. A single leak can give criminals enough to open accounts, file fraudulent taxes, or begin phishing campaigns that look legitimate because they reference your child’s school.

The Doxxing and Identity-Chain Risk

Education breaches rarely stop at one dataset. The exposed PII often links usernames, student IDs, or parent email addresses that appear in gaming accounts, social media, or family-shared logins. Attackers follow these connections to map an entire household. A credential found in the Infinite Campus Salesforce records can unlock a child’s Roblox, Minecraft, or Fortnite account, which in turn reveals friends lists, chat history, and additional personal details that accelerate doxxing.

Once the chain begins, recovery becomes harder. Public records, people-search sites, and data brokers amplify the original leak, making it easier for harassers or identity thieves to locate your physical address or target younger family members.

ShinyHunters’ Public Track Record

Public reporting attributes ShinyHunters with emerging in 2020 and conducting high-profile attacks on platforms including Microsoft, AT&T, and numerous smaller organizations. The group’s typical playbook involves initial access through stolen credentials or vulnerabilities in third-party software, followed by exfiltration of customer and employee databases. They then extort the victim with a short deadline, threatening to publish the data on their leak site and sometimes promising secondary harassment campaigns. In this case they have followed that pattern, giving Infinite Campus until March 25, 2026 before full disclosure.

What to Do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what chains back to the Infinite Campus exposure.
• Rotate any password you used with Infinite Campus or related school portals anywhere it has been reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 15.4B+ breach records and 100+ platforms so the next leak that touches your family is caught in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which frequently become the next link in doxxing chains after education breaches.
• Let remediation specialists handle takedown requests across data brokers and people-search sites while you focus on securing accounts at home.

The Infinite Campus incident is a reminder that your family’s information often lives in systems you do not directly control. Taking concrete steps now limits how far attackers can travel once data escapes. DoxxScan by GalaxyWarden delivers continuous monitoring across 15.4 billion breach records and more than 100 platforms, AI-powered identity-chain mapping that connects handles to real identities, and hands-on remediation by specialists who manage takedowns for you. Its household coverage includes children’s gaming accounts that often serve as the next stepping stone after credential leaks like this one.