Breachesby GlyphRingCentral
Disclosed Jul 28, 20261,596,490 accountsConfirmed
RingCentral social engineering breach exposes 1.6 million accounts
RingCentral disclosed a sophisticated social engineering campaign that let attackers steal customer data without affecting its core platform. ShinyHunters leaked 280 GB after a ransom refusal, and Have I Been Pwned counted 1.6 million accounts.
What is known
| People affected | 1,596,490 (accounts in the leaked data, per Have I Been Pwned) |
|---|---|
| Disclosed | Jul 28, 2026 |
| Discovered | Jul 2026 |
| Happened | Jul 27, 2026 |
| Attack | Phishing |
| Data exposed | EmailsNamesPhone numbersAddresses |
| Sector | Tech · US |
| Status | Confirmed |
| Check your email | Have I Been Pwned |
Sources
Notices filed
History of this record
aggregator to officialby seedSource
https://haveibeenpwned.com/Breach/RingCentral to https://www.ringcentral.com/trust-center/security-bulletin.htmlby seedSource
disclosed to confirmedby seedSource
empty to researchby seedSource
0 to 1by seedSource
empty to USby seedSource
extortion to phishingby seedSource
2026-08-13 to 2026-07-28by seedSource
empty to 2026-07by seedSource
In July 2026, the cloud-based business communications platform RingCentral was the target of a ShinyHunters "pay or leak" extortion campaign . The group subsequently published data they claimed was obtained from the platform, which included to RingCentral disclosed a sophisticated social engineering campaign that let attackers steal customer data without affecting its core platform. ShinyHunters leaked 280 GB after a ransom refusal, and Have I Been Pwned counted 1.6 million accouby seedSource
empty to RingCentral social engineering breach exposes 1.6 million accountsby seedSource
First recordedby backfillSource
First seen 2026-09-25 (Have I Been Pwned), confirmed by Research. Record counts are as reported. Not legal advice.