RingCentral, a provider of cloud-based communication and collaboration platforms, has confirmed a data breach affecting a portion of its customer accounts. The company disclosed on July 28 that its systems were compromised through a "sophisticated social engineering campaign." While RingCentral has not publicly attributed the attack to a specific group, the ShinyHunters extortion gang claimed responsibility on July 27, asserting they had stolen 623GB of data.
Following RingCentral's refusal to pay a ransom, ShinyHunters reportedly leaked a compressed archive containing 280GB of files on their dark web leak site. The data breach notification service Have I Been Pwned subsequently confirmed the authenticity of the leaked data after analysis. Have I Been Pwned reported on Thursday that the breach exposed records for 1.6 million RingCentral accounts.
The compromised information includes names, email addresses, phone numbers, and physical addresses of affected individuals. RingCentral stated that the incident did not impact its core platform and that services continue to operate without disruption. The company also indicated that it has not observed any new unauthorized activity since implementing remediation efforts.
RingCentral is directly communicating with affected customers. The company has advised that individuals who have not been contacted by RingCentral are not impacted by this incident.
ShinyHunters, the group claiming responsibility, has been linked to numerous other data breaches. Over the past year, they have claimed responsibility for breaches affecting hundreds of Salesforce customers, alleging the theft of over 1.5 billion records in campaigns targeting Salesloft Drift and Salesforce Aura. The group has also been associated with security incidents at more than a dozen Snowflake customers and various third-party integration providers. More recently, ShinyHunters claimed a new series of breaches across over 100 organizations, reportedly exploiting an Oracle PeopleSoft zero-day vulnerability.
