The personal information of 1.6 million individuals appears to have been stolen from the widely used business communications platform RingCentral by a notorious extortion group.
The incident occurred in July and was the result of a “sophisticated social engineering campaign”, RingCentral said in a notice on its website.
“Upon detection, we promptly took steps to stop the unauthorized activity and immediately began an investigation with assistance from a leading third-party forensic firm. We have not seen any new unauthorized activity since taking these remediation efforts,” the company said.
According to RingCentral, only a limited portion of its customers was affected by the attack, and those individuals were notified directly.
“If you are not contacted by RingCentral, you are not affected. This incident did not impact the core RingCentral platform, and our services continue to operate without disruption,” it said.
While RingCentral did not name the attackers, the ShinyHunters extortion group added the company to its Tor-based leak site in late July, claiming it stole over 623 gigabytes of data.
Roughly a week later, as RingCentral did not succumb to the extortionists’ demands, ShinyHunters published a 280GB archive containing the data allegedly stolen from the company.
On Thursday, data breach reporting site HaveIBeenPwned added the leaked information to its database, saying that it includes approximately 1.6 million unique email addresses, accompanied by names, addresses, and phone numbers.
RingCentral has yet to confirm the attackers’ claims and the number of potentially impacted individuals.
RingCentral is a cloud-based provider of unified communications and contact center solutions. Its platform delivers business phone, team messaging, video meetings, and AI-assisted tools for employee collaboration and customer interactions.
Responding to a SecurityWeek inquiry, a RingCentral spokesperson provided the following statement:
“RingCentral recently addressed a social engineering incident that affected a limited number of customers. Upon detection, we promptly took steps to stop the unauthorized activity and have not seen any new unauthorized activity since taking these efforts. We also began an investigation with assistance from a third-party forensic firm to investigate what happened and what data may have been impacted. This incident did not impact the RingCentral core platform and our services continue to operate without disruption. The investigation is ongoing, and we are communicating with customers as appropriate.”
*Updated with statement from RingCentral.
Related: 14,000 Trezor Customers Impacted by Data Breach at ShipMonk
Related: AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions
Related: River Bank Says Hackers Deleted Data Stolen in Ransomware Attack
Related: Brinks Home Discloses Data Breach as Hackers Leak Files
