ShinyHunters & FulcrumSec Ramp Up EdTech Attacks: 137K Accounts Stolen

Cybersecurity professionals monitoring the education sector are witnessing a coordinated onslaught from two distinct threat actor groups: ShinyHunters, known for aggressive data exfiltration and auctioning compromised databases, and FulcrumSec, a ransomware operator crippling international institutions. The scale of the late-spring attacks—137,000 staff accounts from a single vendor and a multi-national school network brought offline—signals that the EdTech attack surface has expanded well beyond traditional ransomware into sophisticated supply-chain exploitation and persistent extortion. For threat intel teams, this is a call to map academic sector TTPs with renewed urgency.

The education technology sector is confronting a severe escalation in cyberattacks, marking a pivotal moment for K-12 districts, higher education, and the platforms that underpin digital learning. Two prominent threat actor groups, ShinyHunters and FulcrumSec, have executed high-impact breaches in 2026, exposing systemic vulnerabilities that extend far beyond individual institutions. On June 16, 2026, ShinyHunters disclosed a fresh wave of victims, including Glendale Community College, Moody Bible Institute, Illinois Central College, and Houston City College, underscoring the group's continued focus on academic targets. This announcement followed a far more extensive breach traced to March, where the same threat actors exploited a vulnerability in the Salesforce-powered back-end of Infinite Campus, a leading student information system. That single compromise exfiltrated personal data from 137,000 school staff accounts across the United States, potentially affecting the 11 million students whose records are managed by the platform in over 3,200 districts. Concurrently, FulcrumSec carried out a ransomware attack on the Global Schools Foundation, a multinational network headquartered in Singapore, in early June 2026, causing operational paralysis and extensive data exfiltration across multiple countries. The dual campaigns illustrate a strategic pivot by cybercriminals: EdTech is no longer a peripheral target but a central repository of sensitive personal, financial, and academic data, often guarded by under-resourced IT departments and aging infrastructure.

“

On June 16, 2026, ShinyHunters disclosed a fresh wave of victims, including Glendale Community College, Moody Bible Institute, Illinois Central College, and Houston City College, underscoring the group's continued focus on academic targets.

Industry context reveals why educational technology platforms have become such attractive prey. The rapid digitization of classrooms, accelerated by the COVID-19 pandemic and sustained by hybrid learning models, created an explosion of interconnected systems—learning management systems, student information systems, administrative portals, and cloud-based collaboration tools. Infinite Campus, for example, serves as a single source of truth for millions of students, aggregating grades, attendance, health records, and special education plans. The ShinyHunters breach targeting its Salesforce instance highlights the cascading risk of supply-chain attacks: one vendor compromise can ripple through thousands of downstream organizations. School districts, often bound by tight budgets and legacy procurement cycles, may lack the resources for advanced threat detection or zero-trust architectures, making them easy marks for credential theft and extortion. The FulcrumSec attack on GSF further demonstrates how international school networks, which consolidate data from geographically dispersed campuses, present a high-value target for ransomware gangs seeking maximum leverage. Such attacks often disrupt not just administrative functions but also classroom instruction, communication, and compliance with increasingly stringent data protection regulations.