RingCentral ringcentral.com RingCentral data breach: what happened and what to do
RingCentral disclosed on 28 July 2026 that its systems were compromised in a social engineering campaign. Have I Been Pwned lists 1,596,490 accounts, with email addresses, names, phone numbers and physical addresses exposed.
View all 13,115 breaches- Breach date
- 27 Jul 2026
- Made public
- 28 Jul 2026
- Affected
- 1,596,490
- Data exposed
- Email addresses, Names, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
RingCentral, the cloud phone and communications company, disclosed a breach on 28 July 2026. Have I Been Pwned (HIBP) gives a breach date of 27 July 2026, added the data on 13 August 2026, and counts 1,596,490 accounts.
What happened
RingCentral said its systems were compromised following what it called a sophisticated social engineering campaign. The extortion group ShinyHunters claimed responsibility on 27 July and demanded a ransom. Reporting says a large archive of data was published after RingCentral didn't pay. The company hasn't said how the attackers got in.
RingCentral said the incident affected data for a limited portion of its customers and that it was contacting affected customers directly. It also said it hasn't seen new unauthorized activity since taking remediation steps, and that core services weren't disrupted. The figure to use for the number of people affected is HIBP's 1,596,490 accounts.
What was exposed
HIBP lists email addresses, names, phone numbers and physical addresses. Passwords aren't on the list.
What that lets criminals do
RingCentral sells business phone systems, so the people in this data are often employees and contacts at companies that use it. That makes the data well suited to targeted fraud. A scammer who knows your name, email, phone number and that you use a company phone service can call or message with a plausible story, such as a billing problem, a voicemail notification or a request from "IT".
The physical address adds weight to extortion or impersonation attempts, and lets a criminal confirm which person at which location they are dealing with.
Because phone numbers are included, expect smishing as well as email phishing. Voicemail and call-recording alerts are especially easy to fake because people already receive them from phone systems.
The company's response
RingCentral said it took remediation steps, was communicating with affected customers, and saw no new unauthorized activity afterwards. It described the attack as social engineering, meaning attackers tricked a person instead of breaking software.
If you use RingCentral
Treat unexpected voicemail, fax or billing notifications with caution. Open the RingCentral app or site yourself to check, instead of using links in the message. If you manage accounts for a company, tell your team to expect convincing messages.
How to check your own exposure
Search your email address on Have I Been Pwned. If the RingCentral entry lists you, you're in the data HIBP processed. Because RingCentral told customers it was contacting those affected directly, look for a message from the company, and check it by logging in to your account instead of using a link. If you got a call, voicemail or text since the breach that quoted your details, note the number it came from and don't engage. A real company will let you hang up and call back on a number you already hold.
What to do if you were in it
- 1
Expect phishing that mentions the breach
Treat unexpected emails, texts and calls with suspicion, especially ones that quote your name, phone number or the company. Don't click links in them. Go to the company's site yourself, or call the number printed on a card or a bill.
- 2
Check voicemail and billing alerts in the app itself
Fake voicemail, fax and invoice notices are an easy scam when the sender knows you use a phone service. Open the app or website directly instead of using the link.
- 3
Warn your team if you manage the account
If you administer RingCentral for a company, tell colleagues to double-check requests that mention their phone or login.
- 4
Be careful with calls that quote your details
A caller who knows your name, number and address isn't proving they are legitimate. Hang up and call the company on a number you already have.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan at Serus to see which breaches include your email address or phone number. Breach data can't be taken back once it's out, so the scan tells you what to change and where to stay alert.
Frequently asked
Was I affected by the RingCentral data breach?
Check your email on Have I Been Pwned. HIBP lists 1,596,490 accounts. RingCentral said it was contacting affected customers directly. A Serus free scan checks your email and phone number against this and other breaches.
What was exposed in the RingCentral breach?
Email addresses, names, phone numbers and physical addresses, according to HIBP. Passwords aren't listed.
Should I change my password?
Passwords aren't listed, so it isn't required by this breach. Changing it and turning on two-factor authentication is still sensible.
How did the attackers get in?
RingCentral described a sophisticated social engineering campaign and hasn't said more about how the access happened.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
