ShinyHunters leaks 1.6 million RingCentral records after ransom demands rejected

Cloud communications provider RingCentral is facing heightened scrutiny after the extortion group ShinyHunters published a massive dataset containing personal information belonging to approximately 1.6 million user accounts. The leak follows a July security incident that RingCentral attributed to a "sophisticated social engineering campaign".

In a security notice published on its site, the provider stated that it took immediate action to halt unauthorized access and engaged a leading third-party forensic firm to conduct an investigation. The company noted that the breach affected a "limited portion" of its client base, emphasizing that core platforms and services were not disrupted.

Ransom Refusal and Dark Web Leak

Despite initial mitigation efforts by RingCentral, the threat actor group ShinyHunters listed the communications platform on its dark web leak site in late July, claiming to have exfiltrated over 623 gigabytes of data.

After RingCentral refused to meet extortion demands, the group released a 280-gigabyte archive containing stolen records. The breach notification service Have I Been Pwned verified the published dataset, confirming it holds 1.6 million unique email addresses alongside corresponding customer names, phone numbers, and physical street addresses.

Rising Phishing and Social Engineering Risks

Security analysts warn that while core application systems and financial data were not breached, the exposure of verified corporate contact details creates immediate operational risks. Threat actors frequently aggregate leaked phone numbers, physical addresses, and email directories to launch targeted spear-phishing campaigns and vishing (voice phishing) operations aimed at corporate networks.

RingCentral confirmed it is communicating directly with impacted account owners, advising that users who have not received direct notification were not compromised in the incident. The company maintains that no new unauthorized activity has been detected since its initial containment measures were applied.