RingCentral, a cloud-based unified communications provider, suffered a data breach in July 2026 due to a sophisticated social engineering campaign. The attackers, identified as the ShinyHunters extortion group, claimed to have stolen over 623 GB of data, which includes personal information of approximately 1.6 million individuals. The stolen data comprises names, addresses, email addresses, and phone numbers. RingCentral responded promptly by halting unauthorized activity and initiating an investigation with a leading forensic firm. The breach affected only a limited portion of customers, who were notified directly. The core RingCentral platform and services were not impacted, and no new unauthorized activity has been detected since remediation efforts began. The breach data was added to the HaveIBeenPwned database for public awareness.

The breach exposed personal information of roughly 1.6 million individuals, including names, addresses, email addresses, and phone numbers. This exposure could lead to increased risks of phishing, identity theft, and targeted social engineering attacks against affected individuals. RingCentral's core services and platform were not disrupted, and the breach did not affect the broader customer base beyond the limited subset notified. No evidence of ongoing unauthorized activity has been reported since remediation.

RingCentral has taken immediate steps to stop the unauthorized access and engaged a third-party forensic firm to investigate the incident. Affected customers have been notified directly. The company advises that if customers have not been contacted, they are not impacted. Since the breach resulted from a social engineering attack, users should remain vigilant against phishing attempts and monitor communications for suspicious activity. RingCentral continues to operate normally, and no further action is required from unaffected users at this time.