Cybersecurity Update, March 23, 2026 – Infinite Campus Reports Data Breach, No Impact to Students

Today we were made aware of a security incident involving Infinite Campus, North Carolina's statewide student information system provider.

No student information is reported as having been breached. However, Infinite Campus has issued a public notice that the NC Department of Public Instruction (NCDPI) also shared with school districts.

This is what we learned:

“On the afternoon of Wednesday, March 18, 2026, an unauthorized actor gained access to an Infinite Campus employee's Salesforce account. Salesforce is the company's internal case management and ticketing system — it is not the student information system itself. Infinite Campus's IT and Security teams detected the intrusion, and the account was immediately disabled.”

Read the complete update from NCDPI. (See also in Spanish translation.)

Here are important points we want you to know: 

• According to Infinite Campus, no student information was breached. 
• The immediate target of the breach was Salesforce data, which includes staff names and contact information commonly available on district websites.
• It has not been confirmed that North Carolina's system was impacted in this cybersecurity incident. 
• If any students, staff, or families in Orange County Schools were impacted by the data breach, Infinite Campus will notify the district about next steps to follow.

OCS has not seen any disruption of services related to Infinite Campus, and we are unable to advise whether any individual’s data has been compromised.

As we continue to look for updates about this incident, we remain committed to supporting students, families, and staff with transparency and care. We always appreciate your continued support of Orange County Schools.

 

[Sent March 23, 2026]