RingCentral data breach exposed info of 1.6 million accounts August 14, 2026 The ShinyHunters extortion group stole personal information from 1.6 million RingCentral accounts after hacking the company in July, according to the data breach notification service Have I Been Pwned. RingCentral is a cloud-based collaboration and communication platform used by over 600,000 businesses for services such as calling, messaging, and voicemail. The company disclosed the incident on July 28, revealing that its systems were compromised following what it described as a "sophisticated social engineering campaign." "We have not seen any new unauthorized activity since taking these remediation efforts. To date, this incident has affected data for a limited portion of RingCentral customers, and we are communicating with affected customers directly," it noted . "If you are not contacted by RingCentral, you are not affected. This incident did not impact the core RingCentral platform, and our services continue to operate without disruption." Although RingCentral has not attributed the breach to a specific threat actor or hacking group and has yet to share further details on the incident, the ShinyHunters extortion gang claimed responsibility on July 27, claiming they had stolen 623GB of data. ​After the company refused to pay a ransom to have the stolen data destroyed, the cybercrime group leaked a compressed archive containing 280GB worth of files on their dark web leak site. While a RingCentral spokesperson didn't immediately reply when contacted by BleepingComputer to confirm ShinyHunters' claims, Have I Been Pwned confirmed the link after analyzing the leaked data and said on Thursday that it contained records for 1.6 million accounts , including names, email addresses, phone numbers, and physical addresses. "In July 2026, the cloud-based business communications platform RingCentral was the target of a ShinyHunters 'pay or leak' extortion campaign," it said. Although RingCentral has yet to share exactly how the threat actors gained access to its systems, ShinyHunters has claimed breaches at hundreds of Salesforce customers over the past year, saying they've stolen over 1.5 billion records in Salesloft Drift and Salesforce Aura campaigns. The extortion group was also linked to security breaches at more than a dozen Snowflake customers , as well as various other third-party integration providers . Most recently, ShinyHunters claimed responsibility for a new series of breaches at over 100 organizations following data-theft attacks that exploited an Oracle PeopleSoft zero-day flaw . Once attackers have valid credentials, only 37% of their actions are blocked Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Related Articles: Kodak confirms data breach claimed by ShinyHunters extortion gang Council of Europe investigates ShinyHunters data breach claims French tax authority data breach affects 678,000 individuals France fines unemployment agency €5 million over data breach

Valve notifies Steam hardware customers of a data breach Social Engineering Previous Article Not a member yet? Register Now You may also like: Microsoft confirms GitHub is down worldwide Microsoft confirms GitHub is down worldwide Hackers arrested over €30M bank fraud exploiting service provider flaw Hackers arrested over €30M bank fraud exploiting service provider flaw Hackers exploit macOS Screen Sharing flaw to deploy Monero miner Hackers exploit macOS Screen Sharing flaw to deploy Monero miner Pixellot discovered and secured hundreds of unmanaged AI agent identities in weeks, not months. Download the case study for how. Pixellot discovered and secured hundreds of unmanaged AI agent identities in weeks, not months. Download the case study for how. Stop AI slopsquatting attacks. Secure open source package ingestion before it hits your build. Stop AI slopsquatting attacks. Secure open source package ingestion before it hits your build. 91% of AI Apps Appeared in 16 Months. Get Material's OAuth Risk Report 91% of AI Apps Appeared in 16 Months. Get Material's OAuth Risk Report Certighost CVE is new. The privilege behind it isn't. Discover where yours is hiding. Certighost CVE is new. The privilege behind it isn't. Discover where yours is hiding. Overdue a password health-check? Audit your Active Directory for free Overdue a password health-check? Audit your Active Directory for free