Critical alert: recent ringcentral data breach. HookPhish team Introduction. The latest breach involves RingCentral with a domain of ringcentral.com. This breach occurred on 2026-07-27. Overview. In July 2026, the cloud-based business communications platform RingCentral was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data they claimed was obtained from the platform, which included 1.6M unique email addresses along with names, physical addresses and phone numbers. In their disclosure notice, RingCentral advised that the incident affected "a limited portion of RingCentral customers" and that it was communicating directly with those affected. the breach of RingCentral poses serious risks, including potential phishing attacks, identity theft, and other security concerns. Breach details. * Breach Name: RingCentral * Breach Date: 2026-07-27 * Compromised Accounts: 1,596,490 * Compromised Data: Email addresses, Names, Phone numbers, Physical addresses Disclaimer. HookPhish does not host, download, or disclose any breached data. This post is editorial cybersecurity news intended to raise awareness of organisations affected by data breaches. Breach details are sourced from publicly available threat-intelligence feeds (Have I Been Pwned) for awareness purposes only. How to protect yourself after a data breach. Breached credentials often resurface in phishing and account-takeover attacks. A few steps sharply cut your exposure: * awareness training - stay ahead of attackers reusing leaked data. * phishing simulations - stay ahead of attackers reusing leaked data. Check whether your organisation's data is already exposed with the free HookPhish data breach checker. Faq. What should I do if I was affected by this breach? Changing your passwords immediately is a crucial first step. Consider using unique, strong passwords for each of your accounts. How can I check if my email address was part of the compromised data? You can use online tools or services that allow you to check if your email address has been involved in recent data breaches. Be cautious about inputting sensitive information into unknown websites and prefer reputable platforms. Is two-factor authentication (2FA) recommended after this incident? Yes, enabling 2FA adds an extra layer of security to your accounts. It's highly recommended to activate 2FA wherever possible to enhance the protection of your online accounts. Should I be concerned about phishing attempts after this breach? Absolutely. Be vigilant for phishing emails or messages attempting to exploit the breached data. Avoid clicking on suspicious links and verify the authenticity of any communication, especially if it asks for personal information or login credentials. Has RingCentral addressed the security issues that led to this breach? RingCentral has not provided specific details about the security measures implemented post-incident. It's advisable to monitor official statements from RingCentral or related authorities for updates on their security enhancements. Are there any legal actions being taken against the perpetrators of this breach? As of now, there is no information on legal actions. Cybersecurity agencies and law enforcement may be investigating the incident. Stay informed through official channels for any developments regarding legal proceedings. Conclusion. This breach serves as a stark reminder of the importance of robust cybersecurity practices. By staying vigilant and informed, HookPhish can better protect ourselves from similar threats.

Phishing service spoofs RingCentral to steal Microsoft 365 accounts. The Greatness phishing-as-a-service (PhaaS) platform has expanded from credential phishing to adversary-in-the-middle attacks and device-code phishing targeting Microsoft 365 accounts. The platform has been active since at least mid-2022, targeting Microsoft 365 users in the United States, Canada, the UK, Australia, and South Africa. It evolved over the years and now targets multiple platforms, including Microsoft 365, iCloud, Yahoo, and Google Workspace. Currently, it is sold for $289 per month to cybercriminals over a Telegram channel with thousands of subscribers. In a recent campaign observed by researchers at email security company ZeroBEC, Greatness operators abused the RingCentral communications platform to bypass email security filters on the recipient side. RingCentral is a communications platform used by businesses for services such as cloud calling, messaging, and voicemail. In the Greatness phishing activity, the attacker impersonated the platform by claiming their emails came from service@ringcentral[.]com, targeting actual users of the service. These emails used fake voicemail and performance-review notifications as lures to entice recipients to open them. Although the messages originated from an unknown IONOS mail server, failed SPF and DMARC checks, and had no DKIM signature, they were still accepted by the receiving systems because RingCentral was whitelisted. Moreover, the emails included a fraudulent banner claiming that the sender had been verified by the organization's safe-sender list, which helped reduce suspicion at the human level. ZeroBEC explains that the tactic achieved a Spam Confidence Level (SCL) of -1 on Microsoft Exchange, allowing them to bypass the normal email filtering stages. Clicking the button embedded in those emails took victims to the Greatness infrastructure, where they were routed either through a Microsoft adversary-in-the-middle (AiTM) phishing flow that captured an MFA-approved authentication token or through a device-code phishing flow. Post-compromise, the attacker replayed Microsoft 365 authentication tokens from VPS and commercial VPN infrastructure to access the compromised accounts. They then enumerated Outlook mailboxes, Teams conversations, SharePoint sites, OneDrive files, contacts, calendars, and registered applications through Microsoft Graph, with access persisting for more than two weeks in some cases. It should be noted that RingCentral recently disclosed a data breach incident which was claimed by threat actor ShinyHunters. "This incident has affected data for a limited portion of RingCentral customers, and we are communicating with affected customers directly," explained the company in a security bulletin published July 28. ZeroBEC comments that it's likely that cybercriminals using Greatness got a list of valid targets, users of the RingCentral platform, from that incident, though a connection cannot be confidently made. The researchers recommend auditing safe-sender lists and replacing blanket domain exclusions with rules requiring valid email authentication. Also, hunt for Greatness infrastructure and suspicious MFA-approved Microsoft 365 sign-ins from hosting or VPN addresses. If compromise is suspected, administrators should revoke all access and refresh tokens, review OAuth consent, Microsoft Graph activity, and access to Microsoft 365 services. NOTE:: ITBrands is using this article for educational or Information purpose only

Phishing service spoofs RingCentral to steal Microsoft 365 accounts. The Greatness phishing-as-a-service (PhaaS) platform has expanded from credential phishing to adversary-in-the-middle attacks and device-code phishing targeting Microsoft 365 accounts. The platform has been active since at least mid-2022, targeting Microsoft 365 users in the United States, Canada, the UK, Australia, and South Africa. It evolved over the years and now targets multiple platforms, including Microsoft 365, iCloud, Yahoo, and Google Workspace. Currently, it is sold for $289 per month to cybercriminals over a Telegram channel with thousands of subscribers. In a recent campaign observed by researchers at email security company ZeroBEC, Greatness operators abused the RingCentral communications platform to bypass email security filters on the recipient side. RingCentral is a communications platform used by businesses for services such as cloud calling, messaging, and voicemail. In the Greatness phishing activity, the attacker impersonated the platform by claiming their emails came from service@ringcentral[.]com, targeting actual users of the service. These emails used fake voicemail and performance-review notifications as lures to entice recipients to open them. Although the messages originated from an unknown IONOS mail server, failed SPF and DMARC checks, and had no DKIM signature, they were still accepted by the receiving systems because RingCentral was whitelisted. Moreover, the emails included a fraudulent banner claiming that the sender had been verified by the organization's safe-sender list, which helped reduce suspicion at the human level. ZeroBEC explains that the tactic achieved a Spam Confidence Level (SCL) of -1 on Microsoft Exchange, allowing them to bypass the normal email filtering stages. Clicking the button embedded in those emails took victims to the Greatness infrastructure, where they were routed either through a Microsoft adversary-in-the-middle (AiTM) phishing flow that captured an MFA-approved authentication token or through a device-code phishing flow. Post-compromise, the attacker replayed Microsoft 365 authentication tokens from VPS and commercial VPN infrastructure to access the compromised accounts. They then enumerated Outlook mailboxes, Teams conversations, SharePoint sites, OneDrive files, contacts, calendars, and registered applications through Microsoft Graph, with access persisting for more than two weeks in some cases. It should be noted that RingCentral recently disclosed a data breach incident which was claimed by threat actor ShinyHunters. "This incident has affected data for a limited portion of RingCentral customers, and we are communicating with affected customers directly," explained the company in a security bulletin published July 28. ZeroBEC comments that it's likely that cybercriminals using Greatness got a list of valid targets, users of the RingCentral platform, from that incident, though a connection cannot be confidently made. The researchers recommend auditing safe-sender lists and replacing blanket domain exclusions with rules requiring valid email authentication. Also, hunt for Greatness infrastructure and suspicious MFA-approved Microsoft 365 sign-ins from hosting or VPN addresses. If compromise is suspected, administrators should revoke all access and refresh tokens, review OAuth consent, Microsoft Graph activity, and access to Microsoft 365 services.