# Infinite Campus Salesforce Breach by ShinyHunters / UNC6040 — 137,100 K-12 School Staff Accounts Exfiltrated and Extorted

> ShinyHunters (Google-tracked UNC6040 intrusion / UNC6240 extortion, part of the Scattered LAPSUS$ Hunters collective) compromised the Salesforce instance of education-technology vendor Infinite Campus via voice-phishing-driven OAuth abuse, exfiltrating a 1.2GB archive of 137,100 unique school-staff records. The data — names, emails, employers, job titles, phone numbers, physical addresses, usernames, and support tickets — was published on the group's data-leak site after Infinite Campus refused to pay. The vendor serves 3,200+ U.S. school districts and manages data for ~11 million students across 46 states.

- **Published:** 2026-06-15T00:00:00Z
- **Last reviewed:** 2026-06-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0804
- **ID:** TL-2026-0804
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Actor:** ShinyHunters
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 18 March 2026, multiple internal security controls at Infinite Campus flagged anomalous activity tied to a Salesforce account belonging to an employee. The account was disabled the same day, and that evening the threat actor contacted the company claiming affiliation with ShinyHunters, a financially motivated extortion group responsible for a year-long wave of Salesforce data thefts across hundreds of organizations. The actor set an extortion deadline of 25 March 2026 and threatened to leak the stolen data. Infinite Campus publicly stated it would not engage with the extortion attempt; the actor subsequently published a 1.2GB archive of 137,100 unique Salesforce records, surfaced via Have I Been Pwned, and disclosed publicly on 15 June 2026.

This incident is one node in the broader 2024-2026 UNC6040 / ShinyHunters Salesforce data-theft campaign. The intrusion technique does not rely on a software vulnerability or a Salesforce platform flaw; it abuses the legitimate Salesforce connected-app OAuth authorization flow. UNC6040 operators place telephone calls (vishing) to English-speaking employees and IT/help-desk staff while impersonating internal IT support. During the call the victim is directed to Salesforce's connected-app setup page (login.salesforce.com/setup) and persuaded to enter an attacker-supplied 8-digit connection/authorization code, which links an attacker-controlled, deceptively named OAuth application — frequently a modified or re-branded build of Salesforce's own Data Loader utility (observed app labels include 'My Ticket Portal' and generic 'Data Loader' clones) — to the victim's Salesforce org. Because the victim performs the OAuth consent, the malicious app inherits the user's API privileges and MFA is effectively bypassed: no further credential prompt is required for the app's API calls.

With a valid OAuth refresh/access token, the operators query and bulk-export Salesforce objects through the API using both the genuine Data Loader and custom Python tooling that emulates Data Loader behavior (observed user-agents include 'Salesforce-Multi-Org-Fetcher/1.0', 'Salesforce-CLI/1.0', 'python-requests/2.32.4', and 'Python/3.11 aiohttp/3.12.15'). Tradecraft includes small initial 'test' queries to fingerprint the org and avoid volume-based alerts, followed by rapid scaling of export volume. Infrastructure is obscured behind Mullvad VPN and TOR exit nodes (multiple 185.220.101.0/24 addresses are well-known TOR exits) to frustrate attribution and bypass IP-based controls. In many engagements the same OAuth/credential foothold is leveraged for lateral movement into Okta, Microsoft 365, and other SaaS platforms.

Monetization is handled by the UNC6240 extortion arm under the ShinyHunters brand: victims receive emails (shinycorp@tuta.com, shinygroup@tuta.com, shinyhuntersgroups@tutamail.com) demanding Bitcoin within a 72-hour window, often months after the initial intrusion. In October 2025 the collective escalated by launching a dedicated 'Scattered LAPSUS$ Hunters' data-leak site naming 39-40 victim organizations (including Qantas, Allianz Life, Cisco, Adidas, LVMH brands, Google, FedEx, Toyota and others) and claiming ~1 billion records, with leaks published 10 October 2025 hours after the FBI/BL2C seizure of BreachForums. The Infinite Campus breach follows the same intrusion-then-extortion playbook. Infinite Campus maintains that core customer databases and sensitive student records were not accessed, characterizing the exposed data as directory-style staff information much of which is publicly available on school websites; ShinyHunters claims the archive contains PII and internal corporate data — a more severe characterization. The incident echoes the December 2024 PowerSchool breach (62M students) in sector and sensitivity, underscoring the K-12 supply-chain risk concentrated in a handful of EdTech SaaS vendors.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1566 Phishing
- T1199 Trusted Relationship
- T1078 Valid Accounts
- T1598 Phishing for Information
- T1621 Multi-Factor Authentication Request Generation
- T1528 Steal Application Access Token
- T1552 Unsecured Credentials
- T1556 Modify Authentication Process
- T1078 Valid Accounts
- T1550 Use Alternate Authentication Material
- T1090 Proxy
- T1685 Disable or Modify Tools
- T1087 Account Discovery
- T1538 Cloud Service Dashboard
- T1530 Data from Cloud Storage
- T1550 Use Alternate Authentication Material
- T1213 Data from Information Repositories
- T1071 Application Layer Protocol
- T1537 Transfer Data to Cloud Account
- T1020 Automated Exfiltration
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [Infinite Campus data breach affects 137,000 school staff accounts](https://www.bleepingcomputer.com/news/security/infinite-campus-data-breach-affects-137-000-school-staff-accounts/)
- [Infinite Campus warns of breach after ShinyHunters claims data theft](https://www.bleepingcomputer.com/news/security/infinite-campus-warns-of-breach-after-shinyhunters-claims-data-theft/)
- [Infinite Campus discloses Salesforce breach as ShinyHunters claims data theft](https://cyberinsider.com/infinite-campus-discloses-salesforce-breach-as-shinyhunters-claims-data-theft/)
- [The Cost of a Call: From Voice Phishing to Data Extortion (UNC6040)](https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion)
- [Google Salesforce Breach: A Deep Dive into the UNC6040 Compromise Chain](https://www.seqrite.com/blog/google-salesforce-breach-unc6040-threat-research/)
- [FBI FLASH: Cyber Criminal Groups UNC6040 and UNC6395 Targeting Salesforce (IOCs)](https://www.ic3.gov/CSA/2025/250912.pdf)
- [FBI warns of UNC6040, UNC6395 hackers stealing Salesforce data](https://www.bleepingcomputer.com/news/security/fbi-warns-of-unc6040-unc6395-hackers-stealing-salesforce-data/)
- [Scattered Lapsus$ Hunters Leak First Wave of Salesforce Victim Data](https://cyberinsider.com/scattered-lapsus-hunters-leak-first-wave-of-salesforce-victim-data/)
- [Hackers launch data leak site to extort 39 victims, or Salesforce](https://www.helpnetsecurity.com/2025/10/06/data-leak-site-extortion-salesforce/)
- [Google Exposes Vishing Group UNC6040 Targeting Salesforce with Fake Data Loader App](https://thehackernews.com/2025/06/google-exposes-vishing-group-unc6040.html)
- [What Salesforce Organizations Need to Know About ShinyHunters and Vishing](https://www.varonis.com/blog/salesforce-vishing-threat-unc6040)
- [Hacker group breached Infinite Campus, school software used by 11 million students](https://cybernews.com/security/software-11m-students-hacked-shinyhunters-attack/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0804