[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJAR3oGlYWflWoZz-c1jmx7aWFQ3XA33xdBKplmIrIIY":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"status":18,"created_at":19,"published_at":20,"article":21,"tags":25,"podcasts":38},"b6cf33e4-58ad-4302-9800-6ad1b842f8ae","third-party-access-controls-failed-at-education-provider","48277e8e-f26a-4b0c-b0c3-34b196995382","Third-Party Access Controls Failed at Education Provider","Infinite Campus suffered a breach when threat actors accessed an employee's Salesforce account, exposing staff contact information for a company serving 11 million students. While the exposed data was mostly publicly available and no student databases were compromised, the incident highlights vulnerabilities in third-party system access controls. The breach occurred through Salesforce, demonstrating how attackers increasingly target cloud service providers to reach their ultimate victims.","**Immediate actions:**\n- Organizations should implement least-privilege access principles for cloud services, regularly audit third-party system permissions, and ensure all cloud accounts have MFA enabled\n\n**Long-term improvements:**\n- This breach could have been prevented through stronger third-party access controls and multi-factor authentication enforcement\n- companies should establish clear policies for what data can be stored in third-party systems and conduct regular security assessments of cloud service providers\n- Employee security awareness training specifically focused on cloud service security and phishing attacks targeting cloud credentials would also reduce risk",[12,13,14,15,16,17],"CIS Control 6","CIS Control 12","NIST AC-2","NIST AC-6","NIST SR-3","GDPR Article 28","published","2026-03-24T15:43:15.6434+00:00","2026-03-24T15:43:15.335+00:00",{"id":7,"url":22,"slug":23,"title":24},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Finfinite-campus-warns-of-breach-after-shinyhunters-claims-data-theft\u002F","infinite-campus-warns-of-breach-after-shinyhunters-claims-data-theft","Infinite Campus warns of breach after ShinyHunters claims data theft",[26,32],{"id":27,"name":28,"slug":29,"description":30,"color":31},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":33,"name":34,"slug":35,"description":36,"color":37},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[]]