The ShinyHunters extortion group conducted a data breach against RingCentral in July 2026 by exploiting a sophisticated social engineering attack. This breach led to the theft of personal data from approximately 1.6 million RingCentral accounts, including names, email addresses, phone numbers, and physical addresses. The attackers claimed responsibility and leaked 280GB of the stolen 623GB data on their dark web site after ransom demands were refused. RingCentral disclosed the incident on July 28, confirming limited customer impact and no disruption to core platform services. The company has taken remediation steps and is communicating directly with affected customers. The breach is part of a broader pattern of ShinyHunters attacks on multiple organizations and cloud service customers.

The breach exposed personal information of 1.6 million RingCentral customers, potentially enabling identity theft, phishing, and other targeted attacks. The core RingCentral platform and services were not disrupted, and no new unauthorized activity has been detected since remediation. The exposure of personal data may have reputational and privacy impacts for affected individuals and the company. The incident also highlights risks from social engineering attacks on cloud service providers.

RingCentral has implemented remediation measures and communicated directly with affected customers. The company reported no ongoing unauthorized activity and no impact on core services. Customers not contacted by RingCentral are not affected. No further immediate action is required from unaffected customers. Organizations should remain vigilant for phishing or social engineering attempts leveraging leaked data. Patch status is not applicable as this is a breach incident rather than a software vulnerability.