October 19–23, 2026: Genesys, the cloud contact-centre software company, announced an incident in which an attacker accessed internal business systems, including a learning management system and a CRM environment. Genesys said on October 23 that the incident was fully contained and that the attacker likely downloaded information. Canonical: genesys2026. Primary reporting: SecurityWeek.
Genesys sells software that large organisations use to run customer service, sales and support contact centres. The company stresses that its customer-facing platforms were not the target. The systems involved were the ones Genesys uses to run its own business, including the systems that hold records used to manage relationships with customers. That distinction matters for customers: a breach of a vendor's internal tools can still expose the contact details of the people those customers work with.
What happened
- October 19: Genesys announced the incident.
- October 23: the company said the incident was fully contained.
- Start of access: not disclosed. Genesys has not said when the attacker first got in.
- Systems: internal business systems, including a learning management system and a CRM environment.
Verified and unverified
- Verified (Genesys): unauthorised access to data in internal business systems. The investigation into scope and impact is still under way.
- Likely, not confirmed: the attacker downloaded information. Genesys describes theft as probable, not established.
- Unverified (group claim): ScarlettGroup, a group that has only recently appeared, claimed the attack on its leak site. Genesys has not named the attacker or confirmed the claim.
- Not affected (Genesys): Genesys Cloud, Genesys Engage and Genesys Engage Cloud. Genesys says there was no unauthorised access to those platforms or to customer and partner data stored in them.
What data may be involved
According to SecurityWeek's summary of the company's description, the potentially affected fields are names, phone numbers, work email addresses, job titles, company and account details, and other customer interaction records. The data is business information used to manage relationships with existing and prospective customers. The reporting does not mention employee data. Genesys has not published a count of affected people, so the catalog row records zero.
Why it matters
Business contact data is less sensitive than payment or identity data, but it is very useful for targeting. A message that names a real contact, their job title, the company they work for and a recent support topic looks far more convincing than generic phishing. Organisations that use Genesys should assume attackers now have the affected fields.
What to do
- Ask your Genesys account team whether your tenant's data was in the affected CRM or learning systems, and ask for that answer in writing.
- Brief staff on targeted phishing. A request that quotes real names, roles or past support tickets can still be fraudulent.
- Confirm unusual requests through a known channel. Payment changes, new bank details and credential resets should be checked by calling a number you already have, not one given in the message.
- Review admin accounts connected to Genesys, and any shared credentials stored in CRM or training tools, and rotate them where needed.
Reference links
Related reading
- Amadeus iHotelier: hotel reservation data exposed through a vendor, another case of vendor-held contact and booking data being exposed
- Sony Network Communications (So-net and plala), another October 2026 member-data disclosure