ShinyHunters Extortion Gang Leaks Data from 1.6 Million RingCentral Accounts

The ShinyHunters extortion group obtained personal information tied to 1.6 million RingCentral accounts after breaching the company in July, according to the data breach notification service Have I Been Pwned.

ShinyHunters stole and later leaked the data. The gang asserted responsibility on July 27 after the company declined to meet a ransom demand. It then published a compressed 280GB archive on its dark web leak site. Have I Been Pwned examined the material and confirmed it holds records for 1.6 million accounts that include names, email addresses, phone numbers, and physical addresses.

RingCentral first revealed the compromise on July 28. The firm said its systems had been penetrated through what it called a "sophisticated social engineering campaign." It added that it has observed "no new unauthorized activity since taking these remediation efforts."

The breach affected only a limited portion of customers. The company reported that the incident touched data belonging to only a limited portion of RingCentral customers and that it is reaching out directly to those impacted. RingCentral stated, "If you are not contacted by RingCentral, you are not affected." It further stressed that the event "did not impact the core RingCentral platform, and our services continue to operate without disruption."

RingCentral provides a cloud-based collaboration and communication platform relied on by over 600,000 businesses for calling, messaging, and voicemail. The company has not linked the intrusion to any particular threat actor and has released no additional technical details on the initial access method.

ShinyHunters has a track record of similar attacks. Over the past year the group has asserted responsibility for intrusions at hundreds of Salesforce customers, claiming theft of more than 1.5 billion records during Salesloft Drift and Salesforce Aura campaigns. It has also been tied to compromises at more than a dozen Snowflake customers and multiple other third-party integration providers. Most recently, ShinyHunters took credit for a fresh wave of breaches at over 100 organizations that followed exploitation of an Oracle PeopleSoft zero-day vulnerability.