Infinite Campus, a popular system for managing student data in K-12 schools, is notifying clients about a data security incident that followed an extortion attempt.

According to the notification sent to its users, Infinite Campus reported that hackers gained unauthorized access to an employee’s Salesforce account, revealing mostly publicly accessible information.

While the company hasn’t released a public statement, customers have been discussing the event on various platforms.

This notification follows a claim by the ShinyHunters group that they were responsible for the attack. They also posted a “final warning” on their dark web page, threatening to release all the data they claim to have stolen from Infinite Campus.

The hackers demanded that the company contact them by March 25 to negotiate a ransom and prevent the data leak. However, Infinite Campus has stated it will not communicate with the attacker.

ShinyHunters asserts that they acquired Salesforce data containing personal information and internal company records.

Infinite Campus is an American EdTech company providing a student information system to over 3,200 school districts nationwide. The software is used to manage the data of 11 million students across 46 states.

Although Infinite Campus didn’t explicitly name ShinyHunters, it mentioned the intruder was “part of a group known for targeting Salesforce accounts of numerous companies.”

The group has been targeting Salesforce users for the past year, compromising hundreds of organizations, and claiming over 1.5 billion stolen records in the Salesloft Drift hack and the more recent Salesforce Aura campaign.

Infinite Campus has also stated that their investigation found no customer databases were accessed. The compromised data included names and contact details of school staff, and mostly publicly available information.

“Their target was the Infinite Campus Salesforce instance, consisting of names and contact information for school staff; the majority is directory information commonly found on school websites,” the company clarified.

In response, the company has restricted access to certain customer-facing services for users without IP address restrictions in order to reduce the chances of sensitive data exposure.

The company is also investigating all potentially compromised data in Salesforce and reaching out to possibly affected districts to provide support.

BleepingComputer has contacted Infinite Campus for clarification on the extent of the impact to school distrcits, but has not yet received a reply.

This situation is similar to a previous incident targeting PowerSchool in December 2024, based on targeted platform, but the overall damage differed significantly, with the earlier attack exposing the confidential information of 62 million students.

The individual responsible for that attack, a 19-year-old college student from Massachusetts, was eventually sentenced to four years in prison, following his admission of wrongdoing in May 2025.