137K School Staff Accounts Hacked: EdTech Data Crisis Hits 3,200 Districts

For the 3,200 U.S. school districts relying on Infinite Campus, the March 2026 breach is a nightmare scenario: a single vendor compromise bled personally identifiable information from 137,000 staff accounts, putting entire student populations at risk. As ShinyHunters adds new institutional victims almost daily, the EdTech crisis underscores how the digital backbone of modern education—once a tool for efficiency—has become a prime vector for data exfiltration, fraud, and operational chaos. School boards and IT leaders must confront the fact that safeguarding student data is now a core educational responsibility.

The education technology sector is confronting a severe escalation in cyberattacks, marking a pivotal moment for K-12 districts, higher education, and the platforms that underpin digital learning. Two prominent threat actor groups, ShinyHunters and FulcrumSec, have executed high-impact breaches in 2026, exposing systemic vulnerabilities that extend far beyond individual institutions. On June 16, 2026, ShinyHunters disclosed a fresh wave of victims, including Glendale Community College, Moody Bible Institute, Illinois Central College, and Houston City College, underscoring the group's continued focus on academic targets. This announcement followed a far more extensive breach traced to March, where the same threat actors exploited a vulnerability in the Salesforce-powered back-end of Infinite Campus, a leading student information system. That single compromise exfiltrated personal data from 137,000 school staff accounts across the United States, potentially affecting the 11 million students whose records are managed by the platform in over 3,200 districts. Concurrently, FulcrumSec carried out a ransomware attack on the Global Schools Foundation, a multinational network headquartered in Singapore, in early June 2026, causing operational paralysis and extensive data exfiltration across multiple countries. The dual campaigns illustrate a strategic pivot by cybercriminals: EdTech is no longer a peripheral target but a central repository of sensitive personal, financial, and academic data, often guarded by under-resourced IT departments and aging infrastructure.

“

On June 16, 2026, ShinyHunters disclosed a fresh wave of victims, including Glendale Community College, Moody Bible Institute, Illinois Central College, and Houston City College, underscoring the group's continued focus on academic targets.

Industry context reveals why educational technology platforms have become such attractive prey. The rapid digitization of classrooms, accelerated by the COVID-19 pandemic and sustained by hybrid learning models, created an explosion of interconnected systems—learning management systems, student information systems, administrative portals, and cloud-based collaboration tools. Infinite Campus, for example, serves as a single source of truth for millions of students, aggregating grades, attendance, health records, and special education plans. The ShinyHunters breach targeting its Salesforce instance highlights the cascading risk of supply-chain attacks: one vendor compromise can ripple through thousands of downstream organizations. School districts, often bound by tight budgets and legacy procurement cycles, may lack the resources for advanced threat detection or zero-trust architectures, making them easy marks for credential theft and extortion. The FulcrumSec attack on GSF further demonstrates how international school networks, which consolidate data from geographically dispersed campuses, present a high-value target for ransomware gangs seeking maximum leverage. Such attacks often disrupt not just administrative functions but also classroom instruction, communication, and compliance with increasingly stringent data protection regulations.