Roughly 1.6 million unique email addresses tied to RingCentral, along with customer names, physical addresses, and phone numbers, have been published online after a social-engineering attack that the data-theft and extortion group ShinyHunters claimed. RingCentral acknowledged the intrusion on July 28, calling it a "sophisticated social engineering campaign" that affected a "limited portion of RingCentral customers." The exposed records were tracked by the Have I Been Pwned breach-notification service.
Timeline of the incident
RingCentral said it responded promptly after detecting the intrusion, "took steps to stop the unauthorized activity," and immediately opened an investigation with help from a "leading third-party forensic firm." The company added: "We have not seen any new unauthorized activity since taking these remediation efforts."
RingCentral has not publicly named the attacker, but the notorious ShinyHunters group claimed responsibility in a post on its data-leak site, with screenshots of the post circulating on social media. The criminals said they exfiltrated more than 623 GB of data and set a July 30 deadline for RingCentral to pay up, threatening to publish the stolen material otherwise.
RingCentral apparently declined the extortion demand, and the gang followed through, posting customers' details on the internet. On August 3 the group wrote: "The company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don't care."
The Register's request for comment from RingCentral had not been answered at the time of writing; the story was later amended after comment arrived from ShinyHunters.
How the attackers got in
A ShinyHunters spokesperson said the group broke into RingCentral by voice-phishing an employee and tricking them into giving up their password. The Register's report includes no further technical detail on the initial access or the exfiltration method.
Group profile
Security researcher Dominic Alvieri describes ShinyHunters as his "top threat group and probably is for most analysts." The gang says it has compromised hundreds of organizations since the start of the year, including education technology firms serving schools and universities, as well as healthcare-sector organizations.
The RingCentral dump follows ShinyHunters' recent leak of data from Abbott's cancer diagnostics business, which contained 10.9 million unique email addresses alongside personal and health information. In the Abbott case, the group claims to have exfiltrated more than 30 million rows of customer information — including over one million Social Security numbers and 7.5 million dates of birth — plus more than 22 million rows of client notes holding confidential doctor-patient conversations and health information, and more than 20 million medical-order records containing patient IDs, prescription types, order dates, and refill information.
Technical background: how voice phishing works
This section is general background on this class of attack and is not a description of this specific incident.
Voice phishing (vishing) is a social-engineering technique in which an attacker uses phone calls to extract credentials or approvals from employees. A typical campaign follows a few stages:
- Reconnaissance. The attacker harvests employee names, job titles, and contact details from LinkedIn, corporate directories, or prior breach dumps to make the call seem legitimate.
- Impersonation. The caller poses as IT help desk staff, a vendor, or a senior manager, often fabricating urgency (a "locked account," a "missed deadline," a "security incident").
- Credential capture. The target is pressured into revealing a password, or asked to approve a password reset initiated by the attacker.
- Secondary verification bypass. With a valid password, the attacker may still hit multi-factor authentication (MFA), and may try push-fatigue (bombarding the victim with approval prompts until they accept) or social engineering of the help desk to reset MFA enrollment.
Because the human voice is harder to trace than an email header, vishing is popular with extortion gangs; the same social-engineering playbook was used by ShinyHunters in its Abbott compromise, where staffers were tricked into granting access over the phone.
Generic detection queries
Organizations can look for signs of credential-phishing follow-on activity in identity and sign-in logs. The following are generic examples, not tied to this incident:
az rest --method get --url "https://graph.microsoft.com/v1.0/auditLogs/signIns?\$filter=createdDateTime ge 2026-07-01&\$select=userDisplayName,appDisplayName,ipAddress,location,authenticationRequirement,mfaDetail,isInteractive&\$top=50"
Watch for impossible-travel patterns (a sign-in from one geography followed minutes later by another), new or unrecognized devices, repeated MFA failures or approvals, and successful sign-ins from freshly created accounts.
Generic hardening checklist
- Enforce phishing-resistant MFA (FIDO2/WebAuthn) on all privileged and mailbox accounts.
- Require out-of-band verification before password resets or MFA re-enrollment; never accept caller identity on the phone call itself.
- Train employees that help desk staff never ask for passwords, and to terminate and callback on a known number if pressured.
- Monitor sign-in and MFA logs for push-fatigue and anomalous approval patterns.
- Check for exposed credentials after any breach using the Have I Been Pwned API:
curl "https://haveibeenpwned.com/api/v3/breachedaccount/you@example.com" -H "hibp-api-key: YOUR_KEY" -H "user-agent: your-app"
- Treat any leaked data as compromised: force password rotation and re-authentication for affected accounts, and watch for follow-on phishing that weaponizes the stolen personal details.