Personal information tied to 1.6 million RingCentral accounts has been leaked online by the ShinyHunters extortion group after the cloud communications company refused to pay a ransom, BleepingComputer reported on Aug. 14.
RingCentral provides phone, video and messaging services to businesses, so the leaked contact details give scammers a ready-made list of corporate users to target.
What happened
RingCentral disclosed the incident on July 28, saying its systems were compromised after a sophisticated social engineering campaign. It said the incident affected a limited portion of customers, that it had seen no new unauthorized activity since remediation and that its core platform was not affected. It said it was contacting affected customers directly. The company has not named the attackers or explained exactly how they got in.
ShinyHunters claimed responsibility on July 27 and said it had stolen 623 GB of data. After RingCentral declined to pay, the group published a 280 GB compressed archive on its leak site.
Have I Been Pwned analyzed the leak and found 1.6 million unique email addresses along with names, phone numbers and physical addresses.
Part of a wider campaign
ShinyHunters has spent the past year hitting large companies by tricking employees over the phone into handing over access to cloud platforms and single sign-on accounts, then threatening to leak what it takes. Its victims in 2026 include Charter Communications, McKesson and DentaQuest. The group's tactics rely on people rather than software flaws, which is why security agencies and vendors keep urging companies to adopt phishing-resistant authentication.
What we don't know yet
RingCentral has not said how many customers it is notifying, which internal systems held the stolen data or whether employee information was included.
What to do
RingCentral users should watch for phishing that impersonates RingCentral billing or support, or that uses their business phone number and address to appear legitimate. Administrators should confirm that multi-factor authentication is on for all admin accounts, and train help desks to verify callers before resetting passwords or registering new devices.
