--- title: "Infinite Campus Salesforce-account data incident" description: "Evidence-backed account of Infinite Campus Salesforce-account data incident, covering what happened, impact, timeline, attack vector, technical details, and primary sources." incident_type: "Data incident" status: "active" last_modified: "2026-08-09" canonical_url: "https://www.ally.security/incidents/infinite-campus-salesforce-account-data-incident-2026" markdown_url: "https://www.ally.security/incidents/infinite-campus-salesforce-account-data-incident-2026.md" stix_url: "https://www.ally.security/incidents/infinite-campus-salesforce-account-data-incident-2026/stix.json" --- # Infinite Campus Salesforce-account data incident Unauthorized access to an Infinite Campus employee's Salesforce account and an associated school-staff contact-data exposure. Names and contact information for school staff in the affected Salesforce instance, plus a separately quantified verified HIBP corpus. Last modified Aug 9, 2026 · 2 sources ## Summary - **Environment:** Salesforce platform - **Operational impact:** No outage or recovery duration quantified - **Financial impact:** No public cost estimate ## What happened Unauthorized access to an [Infinite Campus](https://www.infinitecampus.com/) employee's Salesforce account and an associated school-staff contact-data exposure. [2](#source-2) ## Impact Names and contact information for school staff in the affected Salesforce instance, plus a separately quantified verified HIBP corpus. [1](#source-1) [2](#source-2) Documented data types include: - Names — Names in Infinite Campus's stated Salesforce-data boundary and HIBP's DataClasses. [1](#source-1) [2](#source-2) - Customer service records — Support tickets listed in HIBP for the verified corpus. [1](#source-1) [2](#source-2) - Usernames and account identifiers — Usernames listed in HIBP for the verified corpus; passwords or other authenticators are not asserted. [1](#source-1) [2](#source-2) - Employment information — Employers and job titles listed in HIBP for the verified corpus. [1](#source-1) [2](#source-2) - Contact information — Infinite Campus described school-staff contact information; HIBP lists email addresses, phone numbers, and physical addresses for the verified corpus. [1](#source-1) [2](#source-2) A cited record reports 137,123 records (Unique email addresses represented in the verified HIBP corpus; not an Infinite Campus-confirmed number of staff, districts, accounts, support tickets, or affected people; as of 2026-06-15). [1](#source-1) [2](#source-2) That evening, the unauthorized actor contacted Infinite Campus and demanded payment in exchange for destroying Salesforce data the actor claimed to possess. [2](#source-2) Infinite Campus and its security partners were scanning Salesforce data that may have been accessed and said districts would be contacted directly if an additional concern was found. [2](#source-2) ## Timeline ### March 18, 2026 — Documented event Date Infinite Campus said the unauthorized actor gained access to the employee Salesforce account. [2](#source-2) ### March 22, 2026 — Public disclosure Publication date on Infinite Campus's notice. [2](#source-2) ### August 9, 2026 — Briefing updated This briefing was last reviewed and updated on August 9, 2026. ## Threat Group & Attack Vector The incident involved Salesforce platform. [2](#source-2) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - No specific MITRE ATT\&CK technique is currently mapped for this case. ## Response An unauthorized actor gained access to an Infinite Campus employee's Salesforce account on the afternoon of March 18, 2026. The targeted Salesforce instance contained names and contact information for school staff; Infinite Campus said the majority was directory information commonly found on school websites. Infinite Campus said it had not engaged and would not engage with the unauthorized actor. Multiple security measures alerted Infinite Campus's IT and Security teams, and the employee Salesforce account was immediately disabled. As a precaution, Infinite Campus disabled certain services for customers without IP-address restrictions while it evaluated whether sensitive information had appeared in customer communications. Infinite Campus's ongoing investigation indicated that the actor was not attempting to access and had not accessed any customer databases. No access path, attribution, scale, or recovery detail is inferred beyond the cited claims. [1](#source-1) [2](#source-2) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### Infinite Campus breach record advisory · Have I Been Pwned · Jun 15, 2026 ### Notice regarding a security incident official · Infinite Campus, Inc. · Mar 22, 2026
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** March 2026 Infinite Campus Salesforce-account incident: An unauthorized actor gained access to an Infinite Campus employee's Salesforce account on the afternoon of March 18, 2026. 2. **Exposed Data Category · 100% confidence · current** Infinite Campus school-staff contact-data corpus: Names 3. **Resulted In · 100% confidence · current** March 2026 Infinite Campus Salesforce-account incident: The targeted Salesforce instance contained names and contact information for school staff; Infinite Campus said the majority was directory information commonly found on school websites. 4. **Used Product · 100% confidence · current** March 2026 Infinite Campus Salesforce-account incident: Salesforce platform 5. **Exposed Data Category · 100% confidence · current** Infinite Campus school-staff contact-data corpus: Customer service records 6. **Occurred At · 100% confidence · current** March 2026 Infinite Campus Salesforce-account incident: 2026-03-18 7. **Disclosed At · 100% confidence · current** March 2026 Infinite Campus Salesforce-account incident: 2026-03-22 8. **Resulted In · 100% confidence · current** March 2026 Infinite Campus Salesforce-account incident: Infinite Campus said it had not engaged and would not engage with the unauthorized actor. 9. **Resulted In · 95% confidence · current** March 2026 Infinite Campus Salesforce-account incident: Infinite Campus school-staff contact-data corpus 10. **Resulted In · 100% confidence · current** March 2026 Infinite Campus Salesforce-account incident: Multiple security measures alerted Infinite Campus's IT and Security teams, and the employee Salesforce account was immediately disabled. 11. **Affected Organization · 100% confidence · current** March 2026 Infinite Campus Salesforce-account incident: Infinite Campus, Inc. 12. **Resulted In · 100% confidence · current** March 2026 Infinite Campus Salesforce-account incident: That evening, the unauthorized actor contacted Infinite Campus and demanded payment in exchange for destroying Salesforce data the actor claimed to possess. 13. **Resulted In · 100% confidence · current** March 2026 Infinite Campus Salesforce-account incident: As a precaution, Infinite Campus disabled certain services for customers without IP-address restrictions while it evaluated whether sensitive information had appeared in customer communications. 14. **Resulted In · 100% confidence · current** March 2026 Infinite Campus Salesforce-account incident: Infinite Campus and its security partners were scanning Salesforce data that may have been accessed and said districts would be contacted directly if an additional concern was found. 15. **Resulted In · 100% confidence · current** March 2026 Infinite Campus Salesforce-account incident: Infinite Campus's ongoing investigation indicated that the actor was not attempting to access and had not accessed any customer databases. 16. **Exposed Data Category · 100% confidence · current** Infinite Campus school-staff contact-data corpus: Usernames and account identifiers 17. **Exposed Data Category · 100% confidence · current** Infinite Campus school-staff contact-data corpus: Employment information 18. **Exposed Record Count · 100% confidence · current** Infinite Campus school-staff contact-data corpus: 137,123 record 19. **Exposed Data Category · 100% confidence · current** Infinite Campus school-staff contact-data corpus: Contact information