The ShinyHunters extortion group stole personal information from 1.6 million RingCentral accounts after hacking the company in July, according to the data breach notification service Have I Been Pwned.
RingCentral is a cloud-based collaboration and communication platform used by over 600,000 businesses for services such as calling, messaging, and voicemail.
The company disclosed the incident on July 28, revealing that its systems were compromised following what it described as a “sophisticated social engineering campaign.”
“We have not seen any new unauthorized activity since taking these remediation efforts. To date, this incident has affected data for a limited portion of RingCentral customers, and we are communicating with affected customers directly,” it noted.
“If you are not contacted by RingCentral, you are not affected. This incident did not impact the core RingCentral platform, and our services continue to operate without disruption.”
Although RingCentral has not attributed the breach to a specific threat actor or hacking group and has yet to share further details on the incident, the ShinyHunters extortion gang claimed responsibility on July 27, claiming they had stolen 623GB of data.
After the company refused to pay a ransom to have the stolen data destroyed, the cybercrime group leaked a compressed archive containing 280GB worth of files on their dark web leak site.
While a RingCentral spokesperson didn’t immediately reply when contacted by BleepingComputer to confirm ShinyHunters’ claims, Have I Been Pwned confirmed the link after analyzing the leaked data and said on Thursday that it contained records for 1.6 million accounts, including names, email addresses, phone numbers, and physical addresses.
“In July 2026, the cloud-based business communications platform RingCentral was the target of a ShinyHunters ‘pay or leak’ extortion campaign,” it said.
Although RingCentral has yet to share exactly how the threat actors gained access to its systems, ShinyHunters has claimed breaches at hundreds of Salesforce customers over the past year, saying they’ve stolen over 1.5 billion records in Salesloft Drift and Salesforce Aura campaigns.
The extortion group was also linked to security breaches at more than a dozen Snowflake customers, as well as various other third-party integration providers.
Most recently, ShinyHunters claimed responsibility for a new series of breaches at over 100 organizations following data-theft attacks that exploited an Oracle PeopleSoft zero-day flaw.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Kodak confirms data breach claimed by ShinyHunters extortion gang
Council of Europe investigates ShinyHunters data breach claims
Infinite Campus data breach affects 137,000 school staff accounts
Valve notifies Steam hardware customers of a data breach
Levi Strauss & Co. says hackers stole corporate data in cyberattack
Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days
Delta probes Wi-Fi deauth attack on flight carrying DEF CON attendees
New Microsoft Defender ‘ShieldBreak’ zero-day grants SYSTEM privileges
Stop AI slopsquatting attacks. Secure open source package ingestion before it hits your build.
Pixellot discovered and secured hundreds of unmanaged AI agent identities in weeks, not months. Download the case study for how.
Overdue a password health-check? Audit your Active Directory for free
Overdue a password health-check? Audit your Active Directory for free
See how real inboxes, fake stores and AI scams shaped H1 2026 cyber threats
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
