Agentic voice AI communications platform RingCentral has disclosed that it is contacting some of its customers regarding a recent data breach.
The company said in a security update late last month that it had fallen victim to a “sophisticated social engineering campaign”.
“Upon detection, we promptly took steps to stop the unauthorised activity and immediately began an investigation with assistance from a leading third-party forensic firm,” RingCentral said.
“We have not seen any new unauthorised activity since taking these remediation efforts. To date, this incident has affected data for a limited portion of RingCentral customers, and we are communicating with affected customers directly.”
The company said it was only contacting affected customers and that its operations had been unaffected.
RingCentral’s disclosure comes a month after the ShinyHunters cyber extortion group listed the company as a victim on its darknet leak site. At the time, the hackers claimed to have gained access to more than 623 gigabytes of company data, which has since been published to the dark web.
“The company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don’t care,” ShinyHunters said after publishing the data.
Then, in August, data breach tracking site Have I Been Pwned published an update based on ShinyHunters’ claims.
“In July 2026, the cloud-based business communications platform RingCentral was the target of a ShinyHunters ‘pay or leak’ extortion campaign,” Have I Been Pwned said on 13 August after it ingested some of the information into its database of compromised emails.
“The group subsequently published data they claimed was obtained from the platform, which included 1.6 million unique email addresses along with names, physical addresses and phone numbers.”
Who are ShinyHunters?
ShinyHunters is a prolific hacking group responsible for a raft of third-party compromises, and previously linked to a hacking group called Scattered Lapsus$ Hunters, which formed in August 2025 and was responsible for several Salesforce-related compromises, a practice continued by the hackers in their current form.
ShinyHunters itself dates back to 2019.
The group is known for its technical and social engineering skills, and its membership is thought to be largely English-speaking young men. Previous victims include Qantas, Jaguar Land Rover, PornHub, and professional services firm EY.
Who is RingCentral?
RingCentral provides a range of AI-enabled services, including business communications, contact centre solutions, and agentic AI receptionists and virtual assistants.
The company has more than 600,000 customers worldwide, including Optus, Vodafone Business, and AT&T.
RingCentral operates in 46 countries and has a global workforce of at least 8,000 employees. Its Australian office is based in Sydney, NSW.
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
