ShinyHunters extortion of RingCentral leaks 1.6M customer email addresses and contact details; added to HIBP
In July 2026, the cloud-based business communications platform RingCentral was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data it claimed to have obtained from the platform, covering 1.6M unique email addresses along with names, physical addresses and phone numbers. RingCentral stated in its disclosure notice that the incident affected "a limited portion of RingCentral customers" and that it is communicating directly with those affected. Have I Been Pwned added the dataset on 13 Aug 2026.
Technical Details
- Exposed data: email addresses, names, physical addresses and phone numbers.
- The breach occurred in July 2026 as part of a pay-or-leak extortion operation attributed to ShinyHunters; the article does not state the initial access method.
- The 1.6M figure is based on the data the group published and claimed to originate from the platform; RingCentral describes the impact as limited to a portion of its customers.
Remediation
- Use a password manager to generate and store strong, unique passwords, and change any password reused across accounts.
- Enable 2FA wherever it is supported.
- Affected individuals should be alert to phishing and social engineering that leverages the leaked names, addresses and phone numbers.
Linha do tempo
-
ShinyHunters extortion of RingCentral leaks 1.6M customer email addresses and contact details; added to HIBP
ler a análise desta fonte ocultar
In July 2026, the cloud-based business communications platform RingCentral was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data it claimed to have obtained from the platform, covering 1.6M unique email addresses along with names, physical addresses and phone numbers. RingCentral stated in its disclosure notice that the incident affected "a limited portion of RingCentral customers" and that it is communicating directly with those affected. Have I Been Pwned added the dataset on 13 Aug 2026.
Technical Details
- Exposed data: email addresses, names, physical addresses and phone numbers.
- The breach occurred in July 2026 as part of a pay-or-leak extortion operation attributed to ShinyHunters; the article does not state the initial access method.
- The 1.6M figure is based on the data the group published and claimed to originate from the platform; RingCentral describes the impact as limited to a portion of its customers.
Remediation
- Use a password manager to generate and store strong, unique passwords, and change any password reused across accounts.
- Enable 2FA wherever it is supported.
- Affected individuals should be alert to phishing and social engineering that leverages the leaked names, addresses and phone numbers.