RingCentral, the business phone and video-conferencing platform used by companies worldwide, has confirmed that an extortion group calling itself ShinyHunters broke in during July using a social engineering campaign — tricking someone, not exploiting a software bug, to gain access. The group first claimed the intrusion on its dark web leak site on 27 July, saying it had taken roughly 623GB of data. After RingCentral declined to pay a ransom, ShinyHunters published around 280GB of that material publicly. This week, Have I Been Pwned confirmed the dump is genuine and added it to its breach database: records for 1.6 million unique accounts, including names, email addresses, phone numbers, and physical addresses.
RingCentral says the incident did not touch its core platform — calls, meetings, and messaging kept running normally throughout — and that only a limited subset of customers had data exposed. The company states it has directly notified everyone affected, so if you haven't heard from RingCentral, your account isn't part of this. Social engineering rather than a technical exploit has become the preferred entry point for extortion crews this year, because it routes around firewalls and patches entirely by going after the person holding the keys.
What this means for your business
If your company uses RingCentral, check for a direct notification email from them before assuming you're unaffected — and if names, emails, or phone numbers tied to your business were among the exposed records, expect a wave of convincing follow-on phishing that references real account details to look legitimate. More broadly, this breach is a reminder that your vendors' security postures are part of your own: ask any SaaS provider handling your customer or staff data what they train employees to recognise in a social engineering attempt, and whether sensitive account changes require more than a phone call to verify. The technical fix that would have stopped this particular breach barely matters as much as the human one — staff who can pause and question an unusual request, even from someone who sounds like they belong.