Approximately 1.6 million unique email addresses associated with RingCentral accounts have been exposed online, alongside names, physical addresses, and phone numbers. This data dump follows an alleged extortion attempt by the ShinyHunters cybercrime group.
RingCentral publicly acknowledged a security incident on July 28, stating it was subjected to a "sophisticated social engineering campaign" that impacted a "limited portion of RingCentral customers." The communications platform indicated that it detected the intrusion promptly, took immediate steps to halt unauthorized activity, and launched an investigation with the assistance of a third-party forensic firm. The company affirmed that no new unauthorized activity has been observed since these remediation efforts were implemented.
While RingCentral has not officially identified the attacker, ShinyHunters claimed responsibility for the compromise on its data leak site. Screenshots of this claim also circulated on social media. The group asserted that it exfiltrated over 623 GB of data and issued a July 30 deadline for RingCentral to pay a ransom, threatening to release the stolen information if their demands were not met.
RingCentral apparently did not comply with the extortion demand. On August 3, ShinyHunters posted customer details online, stating, "The company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don’t care." The method by which ShinyHunters gained initial access to RingCentral's systems has not been disclosed by the group.
ShinyHunters is a prolific cybercrime organization that has reportedly compromised numerous entities this year, including educational technology providers and healthcare organizations. The group recently dumped data allegedly stolen from Abbott's cancer diagnostics business, which reportedly included 10.9 million unique email addresses along with personal and health information. In that incident, the attackers claimed to have used social engineering to trick staffers into granting them access.
The data from the Abbott breach reportedly contained over 30 million rows of customer information, including more than one million Social Security numbers and 7.5 million dates of birth. More critically, the attackers claimed this haul included over 22 million rows of client notes detailing doctor-patient conversations and health information, as well as more than 20 million medical-order records with patient IDs, prescription types, order dates, and refill information.
