← News
/PLAYBOOK · 2026-08-18

ShinyHunters Breaches RingCentral, 1.6 Million Accounts Leaked: 280GB Published After Ransom Refusal

ShinyHunters socially engineered a breach of the RingCentral cloud communications platform, stole 623GB, then published a 280GB archive after ransom refusal. Have I Been Pwned confirms 1.6 million accounts with name, email, phone, and physical address.

Incident Overview

Ransom crew ShinyHunters, via a carefully planned social-engineering attack, breached cloud communications platform RingCentral in July 2026 and stole a claimed 623GB of customer data. After RingCentral refused ransom, ShinyHunters on 14 August published a 280GB archive on its dark-web leak site. Have I Been Pwned analysis on 14 August confirmed 1.6 million accounts: names, email addresses, phone numbers, and physical addresses. RingCentral disclosed on 28 July and notified affected customers. Core platform unaffected; a subset of connected services leaked customer data.

Incident Details

RingCentral is a cloud communications and collaboration platform serving more than 600,000 enterprise customers: phone, messaging, voicemail, video conferencing SaaS. Attackers used highly sophisticated social engineering against RingCentral insiders for initial access. In the 28 July disclosure RingCentral stated the core communications platform was unaffected, critical business continued, no new unauthorized activity observed, and affected customers would be notified separately.

ShinyHunters claimed the incident on 27 July and claimed 623GB stolen—clear contradiction with RingCentral's "small subset of customers affected." After RingCentral refused ransom to destroy the data, the crew in August published a 280GB compressed archive on its dark-web leak site. Have I Been Pwned on 14 August confirmed 1.6 million account records in the public data. Primary fields: name, email address, phone number, physical address. No payment credentials, password hashes, or call recordings found. RingCentral spokespeople have not publicly confirmed ShinyHunters' claims or the 1.6 million account scale.

Impact Assessment

RingCentral customers include large numbers of mid-market firms, sales teams, contact centers, and remote-work teams. The 1.6 million name+email+phone+address 4-tuples are high-value credential-stuffing material. Through 2024-2025 ShinyHunters already bulk-stole more than 1.5 billion records via Salesforce Aura, Salesloft Drift, Snowflake, and other CRM/data-warehouse platforms. This RingCentral leak is its latest 2026 SaaS lateral harvest.

Attack path: social engineering, not a zero-day. SaaS vendor threat has shifted from system-layer bugs to people-layer bugs. Combined with the crew's recent Oracle PeopleSoft zero-day against 100+ orgs, August 2026 is forming a dual-drive SaaS attack wave: zero-day + social engineering. Enterprise IT/security teams should assume any employee email+phone pair lands in a stuffing dictionary within 30 days. Enforce SSO and MFA. Fully rotate RingCentral-integrated app secrets (OAuth tokens, webhook secrets).

Remediation

For enterprise users of RingCentral:

For customer-side CISOs on the RingCentral platform: demand from RingCentral a complete field list and counts for the affected subset; demand public confirmation of whether any new unauthorized activity was found after 14 August; evaluate moving to a RingCentral SKU with SAML 2.0 and attaching the enterprise IdP (Okta, Azure AD) to isolate the account plane; put RingCentral behind enterprise CASB with real-time alerts on anomalous file downloads and bulk contact exports. On the regulatory side, CPPA, Ireland DPC, Canada OPC and peers are expected to open data-protection inquiries against RingCentral under GDPR/CCPA/PIPEDA.

References