RingCentral customer data stolen after a social engineering attack
RingCentral disclosed on July 28, 2026 that it was the target of a sophisticated social engineering campaign affecting a limited portion of its customers. ShinyHunters claimed the theft, told reporters it had voice-phished an employee into giving up a password, and leaked the data after RingCentral refused to pay; the vishing detail is the group's claim, not RingCentral's.
- Victim
- RingCentral
- Industry
- B2B SaaS
- Country
- United States
- Intrusion began
- Not disclosed
- First disclosed
- Jul 28, 2026
- Actor
- ShinyHunters (claimed) (Extortion group)
- Initial access
- Credential phishing
- Identity control that failed
- Authentication
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
A password given up over the phone was enough to reach customer records. Phishing-resistant MFA removes the value of anything an employee can read out to a caller.
Sources
- 1.6M RingCentral accounts' data dumped after ShinyHunters extortion attack, The Register, Aug 14, 2026
- RingCentral data breach exposed info of 1.6 million accounts, BleepingComputer, Aug 14, 2026
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Mixpanel smishing breach exposes OpenAI API user data 2025 · Credential phishing
- Workday CRM contact data taken in a social engineering campaign 2025 · Credential phishing
- Authy phone numbers enumerated through an unauthenticated endpoint 2024 · Identity infrastructure vulnerability
- Retool SMS phishing, deepfaked call and Google Authenticator cloud sync 2023 · Credential phishing
Cite this record
SWI Community Team. (2026). RingCentral customer data stolen after a social engineering attack. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2026-ringcentral-social-engineering/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.