The ShinyHunters extortion gang stole personal information from more than 137,000 school staff accounts in a Salesforce data theft attack that targeted the widely used Infinite Campus K-12 student information system in March.
Infinite Campus is an education technology (EdTech) company that provides a student information system (SIS) to over 3,200 school districts across the United States, managing data for 11 million students in 46 states.
Although it didn't attribute the incident to a specific hacking group when it notified customers of the breach in March, Infinite Campus described the attacker as "part of a group known for targeting the Salesforce accounts of hundreds of companies."
Infinite Campus also told affected customers that the exposed data contained the names and contact details for school staff and other publicly available information, but added that it had no evidence that customer databases were compromised.
"Their target was the Infinite Campus Salesforce instance, consisting of names and contact information for school staff; the majority is directory information commonly found on school websites," it said.
