The RingCentral Data Breach: What Happened and What Customers Should Do

In July 2026 RingCentral, one of the largest cloud phone providers in the world, confirmed that attackers had got into its systems and walked out with customer data. Within a fortnight the extortion group ShinyHunters had published a large part of it. By mid-August, Have I Been Pwned had verified 1.6 million unique email addresses in the leak.

No calls were intercepted and the phone service never went down. But for any Australian business that runs its phones in the cloud, this breach is worth understanding properly, because the way it happened is the way most communications providers now get breached: not through a clever exploit, but by talking a staff member into handing over access.

This article sets out what is confirmed, what is only claimed, what it means if you are a RingCentral customer, and what every business should ask its phone provider as a result.

1. What Happened: The Timeline

RingCentral has not published a full forensic report, so the timeline below is built from the company’s own statements, the attackers’ claims and independent verification. Where those sources disagree, we say so.

RingCentral’s position throughout has been consistent. In its words, the incident “affected data for a limited portion of RingCentral customers”, it “did not impact the core RingCentral platform, and our services continue to operate without disruption”, and it has “not seen any new unauthorized activity” since remediating.

2. How the Attackers Got In

Here is the honest answer: RingCentral hasn’t said exactly how. It has confirmed social engineering and ruled out a software vulnerability, but it hasn’t named the system that was accessed or the precise path in.

What we can say is how ShinyHunters has operated in its other recent campaigns, because the pattern is well documented:

• Voice phishing of staff. Throughout 2025 the group rang employees at large companies while posing as internal IT support, and talked them into approving access or authorising a malicious application connected to the company’s Salesforce instance. Google’s threat intelligence team tracked this activity at length.
• Fake single sign-on pages. Callers steer the employee to a look-alike login page for Okta or Microsoft Entra ID, capture the password and the one-time code as they are typed, and replay them within seconds.
• Stolen integration tokens. In the Salesloft Drift campaign of August 2025, the group used OAuth tokens from a third-party sales tool to pull data out of hundreds of customer environments without ever touching a password.
• Extortion, not encryption. ShinyHunters rarely deploys ransomware. It copies data, then threatens to publish it. That is exactly what happened here.

The data that leaked (names, addresses, phone numbers and emails) is what you would find in a CRM or customer database rather than in the call-processing platform itself. That is consistent with RingCentral’s statement that calling was unaffected, and consistent with the group’s habit of going after the business systems that sit around a service rather than the service itself.

3. What Data Was Exposed

Have I Been Pwned lists four data classes, and nothing in RingCentral’s statements goes beyond them:

“Not reported” is not the same as “confirmed safe”. The attackers claim to hold 623GB, and only 280GB has been published. Until RingCentral releases its final findings, treat the right-hand column as the best current information rather than a guarantee.

Even so, contact data alone is useful to a criminal. A leak that pairs a business name with the phone administrator’s name, direct number and email address is a ready-made target list for the next round of phishing.

4. The Real Risk for Customers: What Comes Next

The breach itself is over. The follow-on attacks are not. These are the ones we would expect, in rough order of likelihood:

1. Impersonation of RingCentral support. Emails and calls that reference the breach, quote your real account details and ask you to “verify” your login, reset your MFA or install remote support software. This is the most likely threat by a wide margin.
2. Invoice and payment fraud. A convincing message saying your billing details must be updated after the incident, pointing to an attacker-controlled page.
3. Admin account takeover leading to toll fraud. If a phished administrator login gives an attacker control of your phone system, they can enable international calling and run up premium-rate charges over a weekend. Our SIP trunking guide covers how quickly those bills grow.
4. SIM swap and number-port attempts against the mobile numbers in the leak, aimed at intercepting SMS codes.

5. If You Are a RingCentral Customer: Seven Steps

1. Check exposure. Search your admin and billing email addresses on Have I Been Pwned, and check whether RingCentral has written to you directly.
2. Brief your staff today. Tell everyone, not just IT, that RingCentral will not ring them asking for a password, an MFA code or remote access. Any call that does is an attack.
3. Move admins to phishing-resistant MFA. Passkeys or FIDO2 security keys can’t be phished through a fake login page. SMS codes and push approvals can.
4. Reduce the number of admins. Most small businesses have more people with full admin rights to their phone system than they need. Two named people is usually enough.
5. Review the audit log for new admin users, new devices, changed call forwarding rules and international dialling permissions since July.
6. Bar international calls by default and set a spend alert. This one control removes most of the toll fraud risk.
7. Verify through a known channel. If a message about the breach asks you to do anything, close it and contact RingCentral through the number or portal you already use.

6. The Australian Angle: Privacy Act and the NDB Scheme

RingCentral is a US company, but it sells into Australia and many local businesses use it. Two points matter here.

First, your provider’s breach can become your obligation. Under the Privacy Act’s Notifiable Data Breaches scheme, an organisation covered by the Act must notify the OAIC and affected individuals when a breach is likely to result in serious harm, and must assess a suspected breach within 30 days. If your provider holds personal information about your customers (call recordings, contact lists, SMS history), you need to know quickly whether any of it was involved. Contracts should say how fast your provider will tell you.

Second, data location is only part of the story. Australian data residency is worth having, and we rate providers on it. But this breach shows that where the data sits matters less than who can reach it. Ask about both. Our phone system security and compliance guide covers the Privacy Act obligations in more depth.

7. Eight Questions to Ask Any Phone Provider

This isn’t a RingCentral-only problem. Cisco and Twilio were both breached through their staff in 2022 (see our write-ups of the Cisco and Webex incidents and the Twilio SMS phishing breach). Before you sign with anyone, or at your next renewal, ask:

1. Do your own staff use phishing-resistant MFA (FIDO2 keys or passkeys) for every internal system that can reach customer data?
2. How many of your employees can view or export customer records, and is that access logged and reviewed?
3. Which third-party tools (CRM, support desk, sales apps) hold our data, and how are their integrations secured?
4. How quickly will you notify us of a breach affecting our data, and is that written into the contract?
5. Where is our data stored, and can staff outside Australia access it?
6. Do you hold current ISO 27001 or SOC 2 Type II certification, and will you share the report?
7. Can we enforce SSO and our own MFA policy for every user on our account?
8. What spend controls and fraud alerts can we set ourselves, without raising a ticket?

A provider that answers these clearly and in writing is telling you something useful. One that deflects is too. If the answers push you towards a change, our switching checklist covers how to move without dropping calls.

8. The Bottom Line

The RingCentral breach was serious but narrow: contact data for about 1.6 million accounts, no confirmed exposure of call content, and no outage. For most customers the biggest risk now is the wave of convincing phishing that a leak like this makes possible.

The wider lesson is the one the whole industry keeps relearning. The strongest encryption in the world does nothing if an attacker can ring a staff member, sound like IT, and be handed the keys. Choose a provider that has clearly designed for that attack, and protect your own admin accounts as if someone is already trying.

Sources

• BleepingComputer: RingCentral data breach exposed info of 1.6 million accounts
• Have I Been Pwned: RingCentral breach entry
• SecurityWeek: 1.6 million likely impacted by RingCentral data breach
• OAIC: Notifiable Data Breaches scheme

Frequently Asked Questions

What happened in the RingCentral data breach?

In July 2026 the ShinyHunters extortion group gained access to RingCentral systems through social engineering and stole customer data. RingCentral disclosed the incident on 28 July 2026 and refused to pay a ransom, after which the group leaked a 280GB archive. Have I Been Pwned verified 1.6 million unique email addresses in the leaked data.

What data was exposed in the RingCentral breach?

The verified data classes are names, email addresses, phone numbers and physical addresses. Passwords, payment details, call recordings and message content have not been reported as exposed, although RingCentral has not yet published a full forensic report.

Were RingCentral calls or recordings hacked?

No evidence of that has been reported. RingCentral says the incident did not impact its core platform and that services continued without disruption. The leaked data is contact and account information of the kind held in customer databases, not call content.

Who was behind the RingCentral hack?

ShinyHunters, an extortion group that steals data and threatens to publish it rather than encrypting systems with ransomware. The same group has been linked to data theft from Salesforce customers, the Salesloft Drift token campaign and Snowflake customer environments.

Should I stop using RingCentral?

Not necessarily. The breach was limited to contact data and the calling platform was not affected. The practical steps are to warn staff about follow-on phishing, move administrators to phishing-resistant MFA, review audit logs, bar international calling by default and ask your provider, whoever it is, how it protects customer data from social engineering of its own staff.

Do Australian businesses have to report a provider’s data breach?

If your provider’s breach exposes personal information you are responsible for, and it is likely to cause serious harm, the Notifiable Data Breaches scheme under the Privacy Act may require you to notify the OAIC and affected individuals. You must assess a suspected eligible breach within 30 days, so you need your provider to tell you promptly what was involved.