2026 RingCentral — social engineering; HIBP 1.6M accounts (names/emails/phones/addresses)
Data compromised
HIBP: names, email addresses, phone numbers, physical addresses for ~1.6 million accounts. RingCentral: limited portion of customers notified; core platform not disrupted. If someone contacts you about your account, use RingCentral’s official support number — do not trust inbound callbacks. If RingCentral has not contacted you, the company says you are not affected.
Technical writeup
Verified SaaS contact-data breach. RingCentral trust-center bulletin (from Jul 28 2026): sophisticated social-engineering campaign; investigation with a third-party forensic firm; limited customer cohort notified; core UCaaS unaffected. ShinyHunters listed RingCentral ~Jul 27 claiming ~623GB; later dump analysed by Have I Been Pwned (~1.6M unique emails + names/phones/addresses; loaded Aug 13–14 2026). Press (The Register / TNW) cites ShinyHunters saying access came from vishing an employee. Catalog recordsAffected 1600000 (HIBP); companyConfirmed true.
Root cause
Sophisticated social-engineering / voice-phishing of staff (ShinyHunters pay-or-leak, ~Jul 27 2026; ~623GB claimed). Company bulletin: social-engineering campaign; remediation; no new unauthorized activity observed.
References
- https://www.ringcentral.com/trust-center/security-bulletin.html
- https://www.bleepingcomputer.com/news/security/ringcentral-data-breach-exposed-info-of-16-million-accounts/
- https://haveibeenpwned.com/Breach/RingCentral
- https://www.securityweek.com/1-6-million-likely-impacted-by-ringcentral-data-breach/
- https://thenextweb.com/news/shinyhunters-ringcentral-leak-voice-phishing-ey