Senior Manager

ShinyHunters claims RingCentral breach, says 620GB of data stolen. ShinyHunters has claimed responsibility for a cyber attack on cloud-based communications provider RingCentral, claiming that it infiltrated the company's internal network and exfiltrated more than 620 GB of confidential data. RingCentral is a cloud-based business communications platform that provides services such as business phone systems, video conferencing, team messaging, and contact-center solutions. It helps organisations manage workplace communications through cloud-based tools and integrates with various business applications. Last month, in a data security incident notice published on its website, RingCentral said it had fallen victim to a sophisticated social engineering campaign targeting the company. The cloud-based communications provider immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident. It also took steps to secure the affected systems, stop the unauthorised activity and notified relevant law enforcement authorities about the same. "We have not seen any new unauthorised activity since taking these remediation efforts. To date, this incident has affected data for a limited portion of RingCentral customers, and we are communicating with affected customers directly," the company said. The ShinyHunters hacker group claimed responsibility for the cyber attack on RingCentral, listing the company as a victim on its data leak site. The group claimed it had obtained more than 623 GB of confidential data from the company and threatened to release the database publicly unless a ransom was paid by July 30. After RingCentral declined to pay the ransom, ShinyHunters followed through on its threat by leaking the entire stolen database online. "The company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don't care," the hacker group said. Noted security researcher Troy Hunt, who operates the popular data breach repository Have I Been Pwned, analysed the leaked data and confirmed that the breach compromised 1.6 million unique email addresses, along with names, physical addresses and phone numbers. "To date, this incident has affected data for a limited portion of RingCentral customers, and we are communicating with affected customers directly. If you are not contacted by RingCentral, you are not affected. This incident did not impact the core RingCentral platform, and our services continue to operate without disruption," RingCentral added.

RingCentral data breach: 1.6 million accounts reportedly exposed. RingCentral is facing scrutiny after a social engineering attack reportedly exposed personal information connected to approximately 1.6 million accounts. The cloud-based business communications provider confirmed that it was targeted in what it described as a sophisticated social engineering campaign. While RingCentral says its core platform was not affected, subsequent reporting indicates that names, email addresses, phone numbers, and physical addresses may have been accessed and published online. For businesses, the incident raises important questions about how customer information is protected, how quickly affected organizations are notified, and how a breach involving a major technology provider can create risks beyond the provider's own network. What RingCentral has confirmed. RingCentral published a general security advisory on July 28, 2026. The company said it had recently discovered that it was the target of a sophisticated social engineering campaign. According to RingCentral, it stopped the unauthorized activity and began an investigation with help from a third-party forensic firm. The company said it had not observed additional unauthorized activity after taking corrective action. RingCentral described the impact as limited to data associated with a portion of its customers and said it was contacting those customers directly. Its core platform was not affected, and services continued without disruption. Where the 1.6 million figure comes from. On August 13, 2026, breach notification service Have I Been Pwned added the incident to its database after reviewing information published by the attackers. It identified approximately 1.6 million unique email addresses in the dataset. The exposed information reportedly also included names, physical addresses, and phone numbers. As of August 15, RingCentral had not publicly confirmed that 1.6 million people were affected. It had also not verified the full volume of data allegedly stolen. The number should therefore be understood as an estimate based on independent analysis of the published information, not a final count announced by RingCentral. Public reporting has attributed the incident to the ShinyHunters extortion group, which claimed it stole more than 623 gigabytes of data. RingCentral has not publicly attributed the attack to ShinyHunters or confirmed that figure. The attackers also reportedly claimed that they gained access by voice-phishing an employee and convincing that person to reveal a password. RingCentral has confirmed that social engineering was involved, but it has not publicly confirmed the specific method used. What information was reportedly exposed? Have I Been Pwned identified the following information in the published dataset: * Names * Email addresses * Phone numbers * Physical addresses Its public entry does not list passwords, Social Security numbers, or financial information among the exposed categories. That does not necessarily provide a complete picture of every file involved. Even without those details, this combination of contact information can help criminals create convincing emails, text messages, and phone calls. Why follow-up scams are a concern. After a widely reported breach, criminals often take advantage of the confusion. Employees may receive messages or calls claiming to come from RingCentral, an IT provider, or an internal administrator. They may be asked to reset a password, review a voicemail, install an update, or provide a multifactor authentication code. Because the attacker may already possess accurate personal details, the request can appear legitimate. Leaked information may be reused in phishing, voice phishing, business email compromise, and account takeover attempts. What RingCentral customers should do. RingCentral says it is notifying affected customers directly. Businesses should review any notice carefully, but employees should avoid clicking links or calling numbers in unexpected messages. Organizations should also consider the following precautions: * Warn employees about breach-related phishing and phone scams. * Require strong, unique passwords and multifactor authentication for communications and administrator accounts. * Never approve an unexpected authentication request or give a one-time code to a caller. * Review administrator access, recent activity, integrations, forwarding settings, and unexpected configuration changes. * Report suspicious messages or calls to the IT or security team before responding. Individuals can also use Have I Been Pwned to check whether an email address appears in the published dataset. A match means the address was found in the data reviewed by the service, but it does not replace direct communication from RingCentral or a formal investigation. What this breach means for other businesses. The RingCentral incident is a reminder that cybersecurity is not limited to firewalls, antivirus software, and software patches. Social engineering targets people and the business processes they trust. One convincing phone call may be enough to bypass otherwise strong technical safeguards. It also shows why businesses must pay attention to third-party risk. Technology vendors may hold information that becomes useful to attackers, even when their primary services remain available. The goal is not to panic every time a major provider reports an incident. The goal is to be prepared. Businesses should know which vendors store sensitive information, who receives security notices, and how the organization will respond. Employee awareness training, multifactor authentication, limited administrator access, and a documented incident response plan can all help prevent one breach from leading to another. Incidents like this are also a good reminder to consider who manages your business communications and what kind of support is available when questions arise. If your business is exploring other options, TotalBC's CallNet VoIP provides a locally supported alternative backed by a team you can reach when you need help. Contact TotalBC to learn more about making the switch.

RingCentral data breach hits 1.6 million users. Cloud communications provider RingCentral is investigating a July 2026 data breach after an extortion group published a trove of customer data linked to roughly 1.6 million accounts, including names, email addresses, phone numbers, and physical addresses.[[1]] [[3]] [[10]] The incident stems from a "pay or leak" campaign attributed to the ShinyHunters cybercrime group, which listed RingCentral on its leak site in late July and threatened to release stolen files if a ransom demand was not met.[[5]] [[9]] [[15]] Subsequent reports from breach-tracking services and security outlets say the group ultimately dumped a large compressed archive of internal data on its leak site after RingCentral declined to pay.[[3]] [[10]] RingCentral publicly acknowledged a security incident on July 28, describing a compromise following what it called a sophisticated social engineering campaign against its systems.[[3]] [[6]] The company has said that the breach affected data for a limited portion of its customers, that no new unauthorized activity has been observed since remediation steps were taken, and that the core RingCentral platform continues to operate without disruption.[[2]] [[3]] [[6]] Customers have been told they will be contacted directly if their data was involved and that those not notified are not considered affected.[[2]] [[3]] Independent breach monitors now estimate that the exposed dataset contains about 1.6 million unique email addresses tied to RingCentral accounts, accompanied by associated contact details.[[1]] [[7]] [[8]] One breach-aggregation site further lists Social Security numbers among the data types linked to the incident, though this specific claim has not been prominently echoed in other public reporting and may reflect only a subset of records.[[11]] Have I Been Pwned's analysis indicates that roughly 44 percent of the email addresses in the dump were already present in its database from earlier breaches, underscoring how repeated compromises can amplify identity and fraud risks.[[1]] [[10]] Computer Security While full technical details of the intrusion have not been disclosed, current reporting emphasizes social engineering rather than an exploit of a specific software vulnerability.[[3]] [[6]] The campaign aligns with ShinyHunters' broader playbook of data theft followed by extortion, in which attackers seek payment in exchange for withholding or deleting stolen information, then move to leak sites when targets refuse.[[5]] [[9]] [[15]] The publication of contact data at this scale significantly increases the likelihood of targeted phishing, business email compromise, and account takeover attempts against RingCentral customers and employees.[[7]] [[8]] Organizations that rely on RingCentral are being urged by breach trackers and industry observers to step up phishing awareness, enable multifactor authentication on all accessible accounts, and review email filtering and identity verification processes to catch suspicious login attempts and communications.[[7]] [[8]] [[10]] Affected individuals and companies should monitor for unusual activity tied to exposed email addresses and phone numbers, treat unsolicited messages referencing RingCentral as high-risk, and consider credential resets wherever the same passwords may have been reused across services.[[1]] [[10]]