RingCentral Data Exfiltrated in Security Breach

The July 2026 incident exposed account information for 1.6 million users following a social engineering attack.

Updated on Sept. 27, 2026 in Cybersecurity

Isometric editorial illustration of a heavy-duty industrial server rack, representing enterprise data infrastructure. — RingCentral confirmed a security breach on July 28, 2026, resulting in the exfiltration of metadata for 1.6 million user accounts. AI Illustration. Upload story photo >

Live Poll

Do you trust that major cloud-based service providers are adequately protecting your personal information?

RingCentral disclosed on July 28, 2026, that it suffered a security breach where unauthorized actors exfiltrated 623GB of customer data. The incident impacted 1.6 million accounts, though the company reported its core communication platform remained operational.

Why it matters

The breach highlights the persistent vulnerability of enterprise communications providers to targeted social engineering campaigns. This incident serves as a reminder of the significant volume of sensitive metadata held by third-party infrastructure platforms.

The incident involved the exfiltration of 623GB of data, including names, emails, phone numbers, and addresses. This volume is part of a larger pattern for the responsible group, ShinyHunters, which claims to have stolen 1 billion total records across various targets.

The players

RingCentral

A provider of cloud-based communications and collaboration software used by 600,000 businesses globally.

ShinyHunters

An extortion group known for orchestrating large-scale data breaches and publishing stolen information on dark web leak sites.

The details

The breach was executed through a sophisticated social engineering campaign, a method involving the psychological manipulation of employees to gain unauthorized access to systems. Once inside, the attackers exfiltrated account metadata, including customer contact details and physical addresses. RingCentral confirmed that it declined ransom demands made by the threat actors following the data theft.

July 28, 2026: RingCentral disclosed the security incident.

The Tech Race

The incident follows the established pattern of high-volume data theft attributed to the ShinyHunters group. It sits among a series of global breaches where extortion groups specifically target the central databases of enterprise-grade communication services.

Customers of the platform should expect to receive notifications regarding their specific account status and what data was exposed. Users are advised to remain vigilant against phishing attempts that may leverage the stolen contact information.

The takeaway

The event highlights the risk of relying on centralized platforms for sensitive account metadata. Organizations should prioritize multi-factor authentication protocols to mitigate the impact of successful social engineering against personnel.