RingCentral
Disclosed Jul 28, 20268 weeks ago1,596,490 accountsConfirmed
RingCentral social engineering breach exposes 1.6 million accounts
RingCentral disclosed a sophisticated social engineering campaign that let attackers steal customer data without affecting its core platform. ShinyHunters leaked 280 GB after a ransom refusal, and Have I Been Pwned counted 1.6 million accounts.
What is known
| People affected | 1,596,490 (accounts in the leaked data, per Have I Been Pwned) |
|---|---|
| Disclosed | Jul 28, 2026 |
| Discovered | Jul 2026 |
| Happened | Jul 27, 2026 |
| Attack | Phishing |
| Data exposed | Emails, Names, Phone numbers, Addresses |
| Sector | Tech · US |
| Status | Confirmed |
| Check your email | Have I Been Pwned |
Sources
| Source | |
|---|---|
| Have I Been Pwned: RingCentralhaveibeenpwned.com · Aggregator | Aggregator |
| RingCentral data breach exposed info of 1.6 million accountsbleepingcomputer.com · News | News |
| RingCentral security bulletinringcentral.com · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Researchtotal | Jul 28 | |
| Have I Been Pwnedaccounts in the data | Aug 13 | 1,596,490 |
History of this record
- 2026-09-25 · source_type: aggregator to official · seed source
- 2026-09-25 · source_url: https://haveibeenpwned.com/Breach/RingCentral to https://www.ringcentral.com/trust-center/security-bulletin.html · seed source
- 2026-09-25 · status: disclosed to confirmed · seed source
- 2026-09-25 · verified_by: empty to research · seed source
- 2026-09-25 · verified: 0 to 1 · seed source
- 2026-09-25 · country: empty to US · seed source
- 2026-09-25 · attack: extortion to phishing · seed source
- 2026-09-25 · disclosed: 2026-08-13 to 2026-07-28 · seed source
- 2026-09-25 · discovered: empty to 2026-07 · seed source
- 2026-09-25 · summary: In July 2026, the cloud-based business communications platform RingCentral was the target of a ShinyHunters "pay or leak" extortion campaign . The group subsequently published data they claimed was obtained from the platform, which included to RingCentral disclosed a sophisticated social engineering campaign that let attackers steal customer data without affecting its core platform. ShinyHunters leaked 280 GB after a ransom refusal, and Have I Been Pwned counted 1.6 million accou · seed source
- 2026-09-25 · title: empty to RingCentral social engineering breach exposes 1.6 million accounts · seed source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Have I Been Pwned), confirmed by Research. Record counts are as reported. Not legal advice.