The ShinyHunters extortion group compromised cloud communications platform RingCentral and stole personal information from 1.6 million accounts, according to data breach notification service Have I Been Pwned. RingCentral, used by over 600,000 businesses for calling, messaging, and voicemail, disclosed the incident on July 28, attributing it to a “sophisticated social engineering campaign” that breached its systems.
ShinyHunters claimed responsibility for the breach on July 27, before RingCentral’s public disclosure, stating they had exfiltrated 623 gigabytes of data. After RingCentral refused to pay a ransom to have the stolen data destroyed, the cybercrime group leaked a compressed archive containing 280 gigabytes of files on their dark web leak site.
HIBP Confirms 1.6 Million Affected Accounts
Have I Been Pwned analyzed the leaked data and confirmed on Thursday that it contained records for 1.6 million RingCentral accounts. The exposed information includes names, email addresses, phone numbers, and physical addresses. HIBP entry states: “In July 2026, the cloud-based business communications platform RingCentral was the target of a ShinyHunters ‘pay or leak’ extortion campaign.”
RingCentral told BleepingComputer that the incident affected “a limited portion of RingCentral customers” and that the core platform was not impacted. “If you are not contacted by RingCentral, you are not affected,” the company said, adding that no new unauthorized activity had been detected since remediation efforts began.
ShinyHunters Escalating Campaign
The RingCentral breach fits into a broader ShinyHunters campaign targeting enterprise platforms. The group has claimed breaches at hundreds of Salesforce customers over the past year, saying they stole over 1.5 billion records through Salesloft Drift and Salesforce Aura integrations. ShinyHunters was also linked to security breaches at more than a dozen Snowflake customers and various third-party integration providers.
“If you are not contacted by RingCentral, you are not affected. This incident did not impact the core RingCentral platform, and our services continue to operate without disruption.” – RingCentral spokesperson
Most recently, ShinyHunters claimed responsibility for data-theft attacks exploiting an Oracle PeopleSoft zero-day, compromising over 100 organizations. The group’s tactics have evolved from traditional ransomware to a “pay or leak” extortion model, where they steal data, demand payment, and publish stolen information when victims refuse.
Enterprise Communication Platforms Under Pressure
The breach underscores the growing risk to enterprise communication platforms, which handle sensitive business data and personal information at scale. Social engineering campaigns targeting these platforms have become increasingly sophisticated, with attackers impersonating employees or vendors to gain initial access before moving laterally through cloud environments.
RingCentral serves businesses ranging from small startups to Fortune 500 companies, and the breach highlights how even major enterprise providers remain vulnerable to social engineering. Security researchers note that the ShinyHunters group has become one of the most active extortion operations in 2026, with a growing list of high-profile victims across cloud services and enterprise software.
Sources: BleepingComputer; Have I Been Pwned; RingCentral Trust Center; CSIS Significant Cyber Incidents tracker
discussion