RingCentral Breach Exposes 1.6M Accounts After ShinyHunters Leak

For cybersecurity teams, the RingCentral breach is a case study in how extortion groups turn a social engineering foothold into a 623GB data exfiltration and a 280GB public leak. The target was not a legacy on-prem system but a major cloud UCaaS platform serving 600,000 businesses, which means voice, messaging, and contact data are now part of the breach surface. This incident forces security leaders to re-evaluate how collaboration platforms protect customer PII and how to detect exfiltration from SaaS environments before a pay-or-leak deadline expires.

A breach affecting 1.6 million individuals has emerged from RingCentral, the cloud-based business communications provider, after the ShinyHunters extortion group claimed responsibility and published a 280GB archive on its Tor leak site. RingCentral disclosed the incident on July 28, 2026, describing a "sophisticated social engineering campaign" that compromised a limited portion of customer data. Have I Been Pwned subsequently confirmed that the leaked dataset contains 1.6 million unique email addresses accompanied by names, physical addresses, and phone numbers. The core RingCentral platform was not impacted, and services continue to operate without disruption, according to the company. The incident highlights a significant gap between attacker claims and victim disclosure.

“

A breach affecting 1.6 million individuals has emerged from RingCentral, the cloud-based business communications provider, after the ShinyHunters extortion group claimed responsibility and published a 280GB archive on its Tor leak site.

RingCentral serves more than 600,000 businesses with unified communications, contact center, and AI-assisted voice, video, and messaging tools. The exposure of contact information for 1.6 million accounts is material because business communication platforms are high-value targets for social engineering and downstream phishing. Attackers who obtain names, email addresses, and phone numbers can launch convincing impersonation campaigns against employees, partners, and customers. The fact that ShinyHunters initially claimed 623GB of stolen data, then released roughly 280GB after RingCentral refused to pay, indicates the group curated the leak for maximum reputational pressure. For cybersecurity teams, this is not merely a data-loss event; it is a signal that voice and collaboration infrastructure now sits squarely in the crosshairs of extortion operations.

The initial access almost certainly involved human manipulation rather than a zero-day exploit. RingCentral's description of a "sophisticated social engineering campaign" suggests credential harvesting, MFA fatigue, help desk impersonation, or a combination of these techniques. ShinyHunters has a history of breaching SaaS platforms through stolen credentials and misconfigured third-party services, often using access brokers to obtain valid sessions. In this incident, the group added RingCentral to its leak site in late July, gave the company roughly a week to negotiate, and then published the archive. That timeline matches the modern pay-or-leak playbook: exfiltrate, notify victim, set a countdown, leak if no payment. RingCentral's refusal to pay the ransom is consistent with law enforcement guidance, but it means the stolen records are now circulating among cybercriminals.

For the 1.6 million affected individuals, immediate risks include targeted phishing, smishing, and business email compromise. Because RingCentral is a business communications provider, many of the email addresses likely belong to employees at corporate customers. Threat actors can cross-reference the leaked data with LinkedIn profiles and corporate directories to craft highly personalized fraud. HIBP's addition of the dataset on August 13, 2026 allows individuals to check whether their address was included, but by that point the archive had been publicly available on a dark web leak site for approximately a week. The lag between leak and breach notification aggregation is a recurring problem; often the first warning comes from security researchers rather than the breached organization. RingCentral has stated it notified affected customers directly, but the company has not confirmed the full scope or attributed the attack to ShinyHunters, despite HIBP's explicit identification of the group.